Poll

Has the hackabiliy of the E4 made you buy one :  

Yes, I was already looking at the competition at a similar price, but the hack swung it to E4
136 (23.5%)
Yes, I'd not considered buying a TIC before, but 320x240 resolution at this price justifies it (as either tool or toy!)
279 (48.3%)
Yes, I was going to buy an E5/6/8 class of unit but will now get the E4
27 (4.7%)
No, but am looking out for a cheap i3 to hack
25 (4.3%)
Not yet, but probably will if now that a closed-box hack becomes is possible
111 (19.2%)

Total Members Voted: 537

Author Topic: Flir E4 Thermal imaging camera teardown  (Read 566313 times)

janekivi, mrflibble, lwi004, newguy, Svuppe, saycomp, coryb and 13 Guests are viewing this topic.

Offline Wann

  • Contributor
  • Posts: 34
  • Country: dk
  • Mechanical engineer gone rogue
Re: Flir E4 Thermal imaging camera teardown
« Reply #480 on: November 03, 2013, 08:57:22 AM »
Only needs the camera.cmd in the zip
Quote
addfile flashfs/system/appcore.d/config.d/e8.cfg

That is just too easy...

So when FLIR is uploading new firmware, we should basically be keeping our fingers off?
Or there's no way they can block this?  :box:
Mechanical engineer gone rogue

Offline Wann

  • Contributor
  • Posts: 34
  • Country: dk
  • Mechanical engineer gone rogue
Re: Flir E4 Thermal imaging camera teardown
« Reply #481 on: November 03, 2013, 09:00:49 AM »
Edit: forgot to ask, how much space is left on the flash device?

173 MB...  :=\
Mechanical engineer gone rogue

Offline tnt

  • Regular Contributor
  • *
  • Posts: 230
Re: Flir E4 Thermal imaging camera teardown
« Reply #482 on: November 03, 2013, 09:03:42 AM »
So when FLIR is uploading new firmware, we should basically be keeping our fingers off?
Or there's no way they can block this?  :box:

There is _plenty_ of ways they could block this ... too many to enumerate and I wouldn't want to give them ideas ...

Online mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 5631
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #483 on: November 03, 2013, 09:09:43 AM »
Updated 3rd Jan - enabled zoom in .cfg for Taucher's Beta3 menu hack zoom function.


OK, so this is it.....
Seems to not be bothered about 7zip - I just used Windows "send to compressed folder"

Open E8.cfg in a PC text editor (not anything that will mangle linefeeds etc.!)

At the end of the file, replace xxxxxxxx with the 8-digit serial number of your camera

Save the file (Make sure there is exactly one CRLF at the end of the file)

At a PC command prompt, run

  CRC01 E8.cfg  (on the edited file)

This will display a line in the form
# CRC01 xxxxxxxx

Add this line to the end of the E8.cfg file, so it now looks like :

  # ID xxxxxxxx
  # CRC01 yyyyyyyy

where xxxxxxxx is your serial number and yyyyyyyy is the generated CRC
(should be exactly one CRLF after the CRC)
"CRC" is case sensitive - must be upper case. "01" is zero one

Save the file as flashfs\system\appcore.d\config.d\e8.cfg

Create a zip file containing the flashfs folder tree and camera.cmd
Rename the file from .zip to .fif


Install FLIR tools
Go to the install folder\bin
Turn camera on and plug USB in
Run FLIRInstallNet
Browse to your .fif file

Click Run FIF

Unplug USB, remove battery and replace

Enjoy!


To remove hack :
Run FLIRInstallNet, choose the "Remove_hack" .fif file


USB RNDIS MODE
Do not mess with if you don't know what you're doing!
You can easily brick your camera with careless console commands
If you don't know why you may want to use RNDIS, YOU DON'T!

RNDIS allows FTP and Telnet access, and access to service mode via web interface

web/ftp/telnet 192.168.0.2 login flir, pw 3vlig

To set USB RNDIS mode temporarily - until next hard restart
Run FLIRInstallNet, run the "Set_RNDIS_Temporary" .fif file
You will get a timeout error as it dumps the USB connection.

.fif Scripts are also included to set RNDIS permanently, and also remove permanent RNDIS
These add/remove the appcore.d\factory.d\zrndis.rsc file

When RNDIS is active, USB Mass sotrage and video mode are NOT available.
Access to files is still possible via FTP or the the Flir T3Mon virtual drive util that comes with the RNDIS device drivers

Note FlirInstallNet WILL work over RNDIS.


« Last Edit: January 18, 2014, 09:50:52 AM by mikeselectricstuff »
Mike's Electric Stuff: High voltage, vintage electronics, electrical curiosities
Day Job: UFOs, LEDs etc.
Versatronics & other low-end pick & place forum

Online mrflibble

  • Super Contributor
  • ***
  • Posts: 1727
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #484 on: November 03, 2013, 09:11:06 AM »
Only needs the camera.cmd in the zip
Quote
addfile flashfs/system/appcore.d/config.d/e8.cfg


LOOOOOOL! Seriously? That is just too easy.  ;D Almost too easy.  >:D

Edit: forgot to ask, how much space is left on the flash device?

173 MB...  :=\

From my notes I have:
Code: [Select]

FLASH:
Toshiba AX1682
TAIWAN 13159AE 3
TC58NVG1S3ETA00

SLC NAND FLASH, 256 MBytes
Used 83/256 Mb, that's pretty low usage. Which is a good thing. Plenty room for some extra experimentation. :) Not strange now that I think about it, since that flash will also have to store all the images. Right? I recall Mike mentioning only 1 flash chippie, and two seperate LPDDR's (fpga + cpu).

There is _plenty_ of ways they could block this ... too many to enumerate and I wouldn't want to give them ideas ...

Yup. And I almost hope they'll try some. Preferably one of the predictable ones, because that way the solution has already been done. History, repeat.

Offline Wann

  • Contributor
  • Posts: 34
  • Country: dk
  • Mechanical engineer gone rogue
Re: Flir E4 Thermal imaging camera teardown
« Reply #485 on: November 03, 2013, 09:14:18 AM »
There is _plenty_ of ways they could block this ... too many to enumerate and I wouldn't want to give them ideas ...


I tried running this in a terminal :-/O
Code: [Select]
rm -rf http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardownDidn't work.




Ah just kidding  ^-^
Mechanical engineer gone rogue

Offline tnt

  • Regular Contributor
  • *
  • Posts: 230
Re: Flir E4 Thermal imaging camera teardown
« Reply #486 on: November 03, 2013, 09:20:19 AM »
But I'd be more interested to find out how that .exe gets a shell in the first place and if we can make a software that does it.

Offline Wann

  • Contributor
  • Posts: 34
  • Country: dk
  • Mechanical engineer gone rogue
Re: Flir E4 Thermal imaging camera teardown
« Reply #487 on: November 03, 2013, 09:22:06 AM »
..and of course you should be able to use the same method to install a custom boot screen


My new boot screen:


The seat keeps the heat from my behind.  8)
Mechanical engineer gone rogue

Online mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 5631
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #488 on: November 03, 2013, 09:31:28 AM »
But I'd be more interested to find out how that .exe gets a shell in the first place and if we can make a software that does it.
Yeah, because it's soooo hard now.. - I suppose it would be nice to avoid needing the FLIR software. Nice of them to include all the tools you need ready in the box though!

If you could get the USB comms working standalone, you could in principle do something that reads out the serial no., merges and CRC's the file and copies in a single operation.
Mike's Electric Stuff: High voltage, vintage electronics, electrical curiosities
Day Job: UFOs, LEDs etc.
Versatronics & other low-end pick & place forum

Online mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 5631
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #489 on: November 03, 2013, 09:49:56 AM »
I wonder if a similar method would work on the i series - not sure if files are in the same place
Mike's Electric Stuff: High voltage, vintage electronics, electrical curiosities
Day Job: UFOs, LEDs etc.
Versatronics & other low-end pick & place forum

Offline ixfd64

  • Regular Contributor
  • *
  • Posts: 248
Re: Flir E4 Thermal imaging camera teardown
« Reply #490 on: November 03, 2013, 09:51:01 AM »
A while ago, there was talk of a hidden menu that could be activated by a certain sequence of key presses. Has anyone found it yet?

Offline tnt

  • Regular Contributor
  • *
  • Posts: 230
Re: Flir E4 Thermal imaging camera teardown
« Reply #491 on: November 03, 2013, 10:00:29 AM »
Yeah, because it's soooo hard now.. - I suppose it would be nice to avoid needing the FLIR software. Nice of them to include all the tools you need ready in the box though!

Well not really for the hack itself, just to be able to play and experiment with the OS. I don't want to have to use a FIF to switch it to RNDIS (then switch it back) each time I want a console.


Online mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 5631
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #492 on: November 03, 2013, 10:07:03 AM »
I'm fairly sure you can do it by putting the rndis.rsc file in \flashfs\system\appcore.d\factory.d
This file is in one of the early hack zips.

with rndis the only thing you can't do is webcam mode - you can pull your saved images via the Flir toolbar thing, or FTP
Mike's Electric Stuff: High voltage, vintage electronics, electrical curiosities
Day Job: UFOs, LEDs etc.
Versatronics & other low-end pick & place forum

Online mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 5631
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #493 on: November 03, 2013, 10:12:57 AM »
Mike (and anyone else with an E4):

How useful would you estimate this particular camera is for taking images of PCBs, in enough detail to identify which components are getting warm (with or without the benefit of your recent work)?


Yes -
See pics on this post

The only issue at the moment is adjusting the lens for close-up focus -the lens can be adjusted without opening as it's only locked by the friction of the surrounding rubber, but it's a bit hard to grab hold of. 
 I am working on a tool to do this, as well as looking at using cheap laser cutter lenses


Looking at the moulding on the lens surround could you make a tool out of polymorph? Just soften it and push it against the lens surround.

Maybe - problem is it needs to be rigid enough to push against the outer ring, but hollow enough to not block too much field of view - currently looking at a PCB ring with pins.

Just did a quick test impression with polymorph and seems to be pretty good - just need to figure out what shape the rest needs to be to a useful tool that can be used 'blind' while looking at the screen
Mike's Electric Stuff: High voltage, vintage electronics, electrical curiosities
Day Job: UFOs, LEDs etc.
Versatronics & other low-end pick & place forum

Offline Wann

  • Contributor
  • Posts: 34
  • Country: dk
  • Mechanical engineer gone rogue
Re: Flir E4 Thermal imaging camera teardown
« Reply #494 on: November 03, 2013, 10:17:27 AM »
I'm fairly sure you can do it by putting the rndis.rsc file in \flashfs\system\appcore.d\factory.d
This file is in one of the early hack zips.

with rndis the only thing you can't do is webcam mode - you can pull your saved images via the Flir toolbar thing, or FTP

There is a
Code: [Select]
zlast_RNDIS.rsc in the firmware file for the FLIR iX series firmware. Could you just rename that file, or is the real RNDIS.rsc different?
Mechanical engineer gone rogue


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf