Poll

Has the hackabiliy of the E4 made you buy one :  

Yes, I was already looking at the competition at a similar price, but the hack swung it to E4
274 (27.9%)
Yes, I'd not considered buying a TIC before, but 320x240 resolution at this price justifies it (as either tool or toy!)
444 (45.3%)
Yes, I was going to buy an E5/6/8 class of unit but will now get the E4
49 (5%)
No, but am looking out for a cheap i3 to hack
50 (5.1%)
Not yet, but probably will if now that a closed-box hack becomes is possible
164 (16.7%)

Total Members Voted: 803

Author Topic: Flir E4 Thermal imaging camera teardown  (Read 3769231 times)

Bud and 11 Guests are viewing this topic.

Offline mikeselectricstuffTopic starter

  • Super Contributor
  • ***
  • Posts: 13694
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #475 on: November 02, 2013, 09:28:04 pm »
Yep - just tested and it works. Just trying again from a clean boot with no pre-existing hack file

..and of course you should be able to use the same method to install a custom boot screen
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline Wann

  • Contributor
  • Posts: 34
  • Country: dk
  • Mechanical engineer gone rogue
Re: Flir E4 Thermal imaging camera teardown
« Reply #476 on: November 02, 2013, 09:28:37 pm »
YAY!

Yep - just tested and it works. Just trying again from a clean boot with no pre-existing hack file
Mechanical engineer gone rogue
 

Offline Wann

  • Contributor
  • Posts: 34
  • Country: dk
  • Mechanical engineer gone rogue
Re: Flir E4 Thermal imaging camera teardown
« Reply #477 on: November 02, 2013, 09:38:20 pm »
Yep - just tested and it works. Just trying again from a clean boot with no pre-existing hack file

..and of course you should be able to use the same method to install a custom boot screen

Confirmed  :-+

Ahhh. The resolution  ;D

Now everbody be quiet as a mouse. Maybe FLIR will not find out about this. Maybe we should delete the last hour of posts?  :scared:
Mechanical engineer gone rogue
 

Offline mrflibble

  • Super Contributor
  • ***
  • Posts: 2051
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #478 on: November 02, 2013, 09:38:43 pm »
Yep - just tested and it works. Just trying again from a clean boot with no pre-existing hack file

Neat!  :-+ Now there really is nothing left to do for when I get my E4.  ;D Well, except set up a toolchain and make some small apps. Or did maybe someone beat me to that as well? That would be awesome, because I'd love to get some details on how to set up the toolchain for this device. XD

Edit: forgot to ask, how much space is left on the flash device?
« Last Edit: November 02, 2013, 09:43:55 pm by mrflibble »
 

Offline mikeselectricstuffTopic starter

  • Super Contributor
  • ***
  • Posts: 13694
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #479 on: November 02, 2013, 09:45:25 pm »
Only needs the camera.cmd in the zip
Quote
addfile flashfs/system/appcore.d/config.d/e8.cfg
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline Wann

  • Contributor
  • Posts: 34
  • Country: dk
  • Mechanical engineer gone rogue
Re: Flir E4 Thermal imaging camera teardown
« Reply #480 on: November 02, 2013, 09:57:22 pm »
Only needs the camera.cmd in the zip
Quote
addfile flashfs/system/appcore.d/config.d/e8.cfg

That is just too easy...

So when FLIR is uploading new firmware, we should basically be keeping our fingers off?
Or there's no way they can block this?  :box:
Mechanical engineer gone rogue
 

Offline Wann

  • Contributor
  • Posts: 34
  • Country: dk
  • Mechanical engineer gone rogue
Re: Flir E4 Thermal imaging camera teardown
« Reply #481 on: November 02, 2013, 10:00:49 pm »
Edit: forgot to ask, how much space is left on the flash device?

173 MB...  :=\
Mechanical engineer gone rogue
 

Offline tnt

  • Regular Contributor
  • *
  • Posts: 241
Re: Flir E4 Thermal imaging camera teardown
« Reply #482 on: November 02, 2013, 10:03:42 pm »
So when FLIR is uploading new firmware, we should basically be keeping our fingers off?
Or there's no way they can block this?  :box:

There is _plenty_ of ways they could block this ... too many to enumerate and I wouldn't want to give them ideas ...
 

Offline mikeselectricstuffTopic starter

  • Super Contributor
  • ***
  • Posts: 13694
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #483 on: November 02, 2013, 10:09:43 pm »
Updated 3rd Jan - enabled zoom in .cfg for Taucher's Beta3 menu hack zoom function.


OK, so this is it.....
Seems to not be bothered about 7zip - I just used Windows "send to compressed folder"

Open E8.cfg in a PC text editor (not anything that will mangle linefeeds etc.!)

At the end of the file, replace xxxxxxxx with the 8-digit serial number of your camera

Save the file (Make sure there is exactly one CRLF at the end of the file)

At a PC command prompt, run

  CRC01 E8.cfg  (on the edited file)

This will display a line in the form
# CRC01 xxxxxxxx

Add this line to the end of the E8.cfg file, so it now looks like :

  # ID xxxxxxxx
  # CRC01 yyyyyyyy

where xxxxxxxx is your serial number and yyyyyyyy is the generated CRC
(should be exactly one CRLF after the CRC)
"CRC" is case sensitive - must be upper case. "01" is zero one

Save the file as flashfs\system\appcore.d\config.d\e8.cfg

Create a zip file containing the flashfs folder tree and camera.cmd
Rename the file from .zip to .fif


Install FLIR tools
Go to the install folder\bin
Turn camera on and plug USB in
Run FLIRInstallNet
Browse to your .fif file

Click Run FIF

Unplug USB, remove battery and replace

Enjoy!


To remove hack :
Run FLIRInstallNet, choose the "Remove_hack" .fif file


USB RNDIS MODE
Do not mess with if you don't know what you're doing!
You can easily brick your camera with careless console commands
If you don't know why you may want to use RNDIS, YOU DON'T!

RNDIS allows FTP and Telnet access, and access to service mode via web interface

web/ftp/telnet 192.168.0.2 login flir, pw 3vlig

To set USB RNDIS mode temporarily - until next hard restart
Run FLIRInstallNet, run the "Set_RNDIS_Temporary" .fif file
You will get a timeout error as it dumps the USB connection.

.fif Scripts are also included to set RNDIS permanently, and also remove permanent RNDIS
These add/remove the appcore.d\factory.d\zrndis.rsc file

When RNDIS is active, USB Mass sotrage and video mode are NOT available.
Access to files is still possible via FTP or the the Flir T3Mon virtual drive util that comes with the RNDIS device drivers

Note FlirInstallNet WILL work over RNDIS.


« Last Edit: January 17, 2014, 10:50:52 pm by mikeselectricstuff »
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 
The following users thanked this post: De

Offline mrflibble

  • Super Contributor
  • ***
  • Posts: 2051
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #484 on: November 02, 2013, 10:11:06 pm »
Only needs the camera.cmd in the zip
Quote
addfile flashfs/system/appcore.d/config.d/e8.cfg


LOOOOOOL! Seriously? That is just too easy.  ;D Almost too easy.  >:D

Edit: forgot to ask, how much space is left on the flash device?

173 MB...  :=\

From my notes I have:
Code: [Select]

FLASH:
Toshiba AX1682
TAIWAN 13159AE 3
TC58NVG1S3ETA00

SLC NAND FLASH, 256 MBytes
Used 83/256 Mb, that's pretty low usage. Which is a good thing. Plenty room for some extra experimentation. :) Not strange now that I think about it, since that flash will also have to store all the images. Right? I recall Mike mentioning only 1 flash chippie, and two seperate LPDDR's (fpga + cpu).

There is _plenty_ of ways they could block this ... too many to enumerate and I wouldn't want to give them ideas ...

Yup. And I almost hope they'll try some. Preferably one of the predictable ones, because that way the solution has already been done. History, repeat.
 

Offline Wann

  • Contributor
  • Posts: 34
  • Country: dk
  • Mechanical engineer gone rogue
Re: Flir E4 Thermal imaging camera teardown
« Reply #485 on: November 02, 2013, 10:14:18 pm »
There is _plenty_ of ways they could block this ... too many to enumerate and I wouldn't want to give them ideas ...

I tried running this in a terminal :-/O
Code: [Select]
rm -rf https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardownDidn't work.




Ah just kidding  ^-^
Mechanical engineer gone rogue
 

Offline tnt

  • Regular Contributor
  • *
  • Posts: 241
Re: Flir E4 Thermal imaging camera teardown
« Reply #486 on: November 02, 2013, 10:20:19 pm »
But I'd be more interested to find out how that .exe gets a shell in the first place and if we can make a software that does it.
 

Offline Wann

  • Contributor
  • Posts: 34
  • Country: dk
  • Mechanical engineer gone rogue
Re: Flir E4 Thermal imaging camera teardown
« Reply #487 on: November 02, 2013, 10:22:06 pm »
..and of course you should be able to use the same method to install a custom boot screen

My new boot screen:


The seat keeps the heat from my behind.  8)
Mechanical engineer gone rogue
 

Offline mikeselectricstuffTopic starter

  • Super Contributor
  • ***
  • Posts: 13694
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #488 on: November 02, 2013, 10:31:28 pm »
But I'd be more interested to find out how that .exe gets a shell in the first place and if we can make a software that does it.
Yeah, because it's soooo hard now.. - I suppose it would be nice to avoid needing the FLIR software. Nice of them to include all the tools you need ready in the box though!

If you could get the USB comms working standalone, you could in principle do something that reads out the serial no., merges and CRC's the file and copies in a single operation.
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline mikeselectricstuffTopic starter

  • Super Contributor
  • ***
  • Posts: 13694
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #489 on: November 02, 2013, 10:49:56 pm »
I wonder if a similar method would work on the i series - not sure if files are in the same place
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline ixfd64

  • Frequent Contributor
  • **
  • Posts: 345
  • Country: us
    • Facebook
Re: Flir E4 Thermal imaging camera teardown
« Reply #490 on: November 02, 2013, 10:51:01 pm »
A while ago, there was talk of a hidden menu that could be activated by a certain sequence of key presses. Has anyone found it yet?

Offline tnt

  • Regular Contributor
  • *
  • Posts: 241
Re: Flir E4 Thermal imaging camera teardown
« Reply #491 on: November 02, 2013, 11:00:29 pm »
Yeah, because it's soooo hard now.. - I suppose it would be nice to avoid needing the FLIR software. Nice of them to include all the tools you need ready in the box though!

Well not really for the hack itself, just to be able to play and experiment with the OS. I don't want to have to use a FIF to switch it to RNDIS (then switch it back) each time I want a console.

 

Offline mikeselectricstuffTopic starter

  • Super Contributor
  • ***
  • Posts: 13694
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #492 on: November 02, 2013, 11:07:03 pm »
I'm fairly sure you can do it by putting the rndis.rsc file in \flashfs\system\appcore.d\factory.d
This file is in one of the early hack zips.

with rndis the only thing you can't do is webcam mode - you can pull your saved images via the Flir toolbar thing, or FTP
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline mikeselectricstuffTopic starter

  • Super Contributor
  • ***
  • Posts: 13694
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #493 on: November 02, 2013, 11:12:57 pm »
Mike (and anyone else with an E4):

How useful would you estimate this particular camera is for taking images of PCBs, in enough detail to identify which components are getting warm (with or without the benefit of your recent work)?

Yes -
See pics on this post

The only issue at the moment is adjusting the lens for close-up focus -the lens can be adjusted without opening as it's only locked by the friction of the surrounding rubber, but it's a bit hard to grab hold of. 
 I am working on a tool to do this, as well as looking at using cheap laser cutter lenses

Looking at the moulding on the lens surround could you make a tool out of polymorph? Just soften it and push it against the lens surround.
Maybe - problem is it needs to be rigid enough to push against the outer ring, but hollow enough to not block too much field of view - currently looking at a PCB ring with pins.
Just did a quick test impression with polymorph and seems to be pretty good - just need to figure out what shape the rest needs to be to a useful tool that can be used 'blind' while looking at the screen
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline Wann

  • Contributor
  • Posts: 34
  • Country: dk
  • Mechanical engineer gone rogue
Re: Flir E4 Thermal imaging camera teardown
« Reply #494 on: November 02, 2013, 11:17:27 pm »
I'm fairly sure you can do it by putting the rndis.rsc file in \flashfs\system\appcore.d\factory.d
This file is in one of the early hack zips.

with rndis the only thing you can't do is webcam mode - you can pull your saved images via the Flir toolbar thing, or FTP

There is a
Code: [Select]
zlast_RNDIS.rsc in the firmware file for the FLIR iX series firmware. Could you just rename that file, or is the real RNDIS.rsc different?
Mechanical engineer gone rogue
 

Offline mikeselectricstuffTopic starter

  • Super Contributor
  • ***
  • Posts: 13694
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #495 on: November 02, 2013, 11:33:54 pm »
I'm fairly sure you can do it by putting the rndis.rsc file in \flashfs\system\appcore.d\factory.d
This file is in one of the early hack zips.

with rndis the only thing you can't do is webcam mode - you can pull your saved images via the Flir toolbar thing, or FTP

There is a
Code: [Select]
zlast_RNDIS.rsc in the firmware file for the FLIR iX series firmware. Could you just rename that file, or is the real RNDIS.rsc different?

Attatched are .rsc files for normal and rndis.

I'm not sure what happens if you have both - my best guess is they are read alphabetically, so to do rndis without touching the existing usb.rsc you may need to rename it to something later alphabetically.

(This may explain the  zlast name above)

The files are CR32'd, so can't just be edited without re-CRCing (method a few pages earlier here)   
I did try making one that did all 3 protocols but it went a bit nuts..


BTW a reminder that the first thing you should probably to if playing is run RNDIS and use filezilla to ftp off a backup copy of the whole \flashfs structure, as this is all the data specific to your camera.


« Last Edit: November 02, 2013, 11:47:22 pm by mikeselectricstuff »
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline Wann

  • Contributor
  • Posts: 34
  • Country: dk
  • Mechanical engineer gone rogue
Re: Flir E4 Thermal imaging camera teardown
« Reply #496 on: November 02, 2013, 11:40:50 pm »

Attatched are .rsc files for normal and rndis.

I'm not sure what happens if you have both - my best guess is they are read alphabetically, so to do rndis without touching the existing usb.rsc you may need to rename it to something later alphabetically.
The files are CR32'd, so can't just be edited without re-CRCing (method a few pages earlier here)   
I did try making one that did all 3 protocols but it went a bit nuts..

BTW a reminder that the first thing you should probably to if playing is run RNDIS and use filezilla to ftp off a backup copy of the whole \flashfs structure, as this is all the data specific to your camera.

So the zlast_RNDIS.rsc from the iX firmware file:
Code: [Select]
#
# USB mode MSD
#
.system entry
.system.usbmode text "RNDIS"
# CRC32 d51f0c78

and the rndis.rsc you zipped:
Code: [Select]
#
# Generated at 2000-01-08 21:43:17
# ID
#
.system entry
.system.usbmode text "UVC_MSD"
# CRC32 c37005c3

Hmm... That's the same as the usb.rsc you zipped...?
« Last Edit: November 02, 2013, 11:47:48 pm by Wann »
Mechanical engineer gone rogue
 

Offline mikeselectricstuffTopic starter

  • Super Contributor
  • ***
  • Posts: 13694
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #497 on: November 02, 2013, 11:48:43 pm »
Oops - just updated zip file in above post with correct version
Quote
#
# USB mode MSD
#
.system entry
.system.usbmode text "RNDIS"
# CRC32 d51f0c78
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline Wann

  • Contributor
  • Posts: 34
  • Country: dk
  • Mechanical engineer gone rogue
Re: Flir E4 Thermal imaging camera teardown
« Reply #498 on: November 03, 2013, 12:00:17 am »
(This may explain the  zlast name above)

Ahh. That makes sense.
So does the CRC checks the filename, or is removing "zlast_" via camera.cmd a possibility  :-/O

I've never worked with CRC before :-BROKE
Mechanical engineer gone rogue
 

Offline Wann

  • Contributor
  • Posts: 34
  • Country: dk
  • Mechanical engineer gone rogue
Re: Flir E4 Thermal imaging camera teardown
« Reply #499 on: November 03, 2013, 12:01:22 am »
So does the CRC checks the filename, or is removing "zlast_" via camera.cmd a possibility  :-/O

Nooooo. It's the same CRC32 value for both  ;D
Mechanical engineer gone rogue
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf