Poll

Has the hackabiliy of the E4 made you buy one :  

Yes, I was already looking at the competition at a similar price, but the hack swung it to E4
109 (22.3%)
Yes, I'd not considered buying a TIC before, but 320x240 resolution at this price justifies it (as either tool or toy!)
238 (48.8%)
Yes, I was going to buy an E5/6/8 class of unit but will now get the E4
23 (4.7%)
No, but am looking out for a cheap i3 to hack
21 (4.3%)
Not yet, but probably will if now that a closed-box hack becomes is possible
97 (19.9%)

Total Members Voted: 447

Author Topic: Flir E4 Thermal imaging camera teardown  (Read 380626 times)

Rainer, nowlan and 6 Guests are viewing this topic.

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 4711
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #495 on: November 03, 2013, 10:33:54 AM »
I'm fairly sure you can do it by putting the rndis.rsc file in \flashfs\system\appcore.d\factory.d
This file is in one of the early hack zips.

with rndis the only thing you can't do is webcam mode - you can pull your saved images via the Flir toolbar thing, or FTP

There is a
Code: [Select]
zlast_RNDIS.rsc in the firmware file for the FLIR iX series firmware. Could you just rename that file, or is the real RNDIS.rsc different?

Attatched are .rsc files for normal and rndis.

I'm not sure what happens if you have both - my best guess is they are read alphabetically, so to do rndis without touching the existing usb.rsc you may need to rename it to something later alphabetically.

(This may explain the  zlast name above)

The files are CR32'd, so can't just be edited without re-CRCing (method a few pages earlier here)   
I did try making one that did all 3 protocols but it went a bit nuts..


BTW a reminder that the first thing you should probably to if playing is run RNDIS and use filezilla to ftp off a backup copy of the whole \flashfs structure, as this is all the data specific to your camera.


« Last Edit: November 03, 2013, 10:47:22 AM by mikeselectricstuff »
Mike's Electric Stuff: High voltage, vintage electronics, electrical curiosities
Day Job: UFOs, LEDs etc.
Versatronics & other low-end pick & place forum

Offline Wann

  • Supporter
  • ****
  • Posts: 34
  • Country: dk
  • Mechanical engineer gone rogue
Re: Flir E4 Thermal imaging camera teardown
« Reply #496 on: November 03, 2013, 10:40:50 AM »

Attatched are .rsc files for normal and rndis.

I'm not sure what happens if you have both - my best guess is they are read alphabetically, so to do rndis without touching the existing usb.rsc you may need to rename it to something later alphabetically.
The files are CR32'd, so can't just be edited without re-CRCing (method a few pages earlier here)   
I did try making one that did all 3 protocols but it went a bit nuts..

BTW a reminder that the first thing you should probably to if playing is run RNDIS and use filezilla to ftp off a backup copy of the whole \flashfs structure, as this is all the data specific to your camera.

So the zlast_RNDIS.rsc from the iX firmware file:
Code: [Select]
#
# USB mode MSD
#
.system entry
.system.usbmode text "RNDIS"
# CRC32 d51f0c78

and the rndis.rsc you zipped:
Code: [Select]
#
# Generated at 2000-01-08 21:43:17
# ID
#
.system entry
.system.usbmode text "UVC_MSD"
# CRC32 c37005c3

Hmm... That's the same as the usb.rsc you zipped...?
« Last Edit: November 03, 2013, 10:47:48 AM by Wann »
Mechanical engineer gone rogue

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 4711
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #497 on: November 03, 2013, 10:48:43 AM »
Oops - just updated zip file in above post with correct version
Quote
#
# USB mode MSD
#
.system entry
.system.usbmode text "RNDIS"
# CRC32 d51f0c78
Mike's Electric Stuff: High voltage, vintage electronics, electrical curiosities
Day Job: UFOs, LEDs etc.
Versatronics & other low-end pick & place forum

Offline Wann

  • Supporter
  • ****
  • Posts: 34
  • Country: dk
  • Mechanical engineer gone rogue
Re: Flir E4 Thermal imaging camera teardown
« Reply #498 on: November 03, 2013, 11:00:17 AM »
(This may explain the  zlast name above)

Ahh. That makes sense.
So does the CRC checks the filename, or is removing "zlast_" via camera.cmd a possibility  :-/O

I've never worked with CRC before :-BROKE
Mechanical engineer gone rogue

Offline Wann

  • Supporter
  • ****
  • Posts: 34
  • Country: dk
  • Mechanical engineer gone rogue
Re: Flir E4 Thermal imaging camera teardown
« Reply #499 on: November 03, 2013, 11:01:22 AM »
So does the CRC checks the filename, or is removing "zlast_" via camera.cmd a possibility  :-/O

Nooooo. It's the same CRC32 value for both  ;D
Mechanical engineer gone rogue

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 4711
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #500 on: November 03, 2013, 11:04:00 AM »
(This may explain the  zlast name above)

Ahh. That makes sense.
So does the CRC checks the filename, or is removing "zlast_" via camera.cmd a possibility  :-/O

I've never worked with CRC before :-BROKE
No - it reads all files in the config.d for .cfg and factory.d for .rsc files
Each file must have a valid CRC otherwise it is ignored.

I'm assuming, but not 100% confirmed, that it reads files in alphabetical order, and options in later files override any in earlier files.
.rsc files have CRC32 and are portable between units
.cfg files have CRC01 and include the unit serial number and so are specific to a particular camera.
« Last Edit: November 03, 2013, 11:06:28 AM by mikeselectricstuff »
Mike's Electric Stuff: High voltage, vintage electronics, electrical curiosities
Day Job: UFOs, LEDs etc.
Versatronics & other low-end pick & place forum

Offline Wann

  • Supporter
  • ****
  • Posts: 34
  • Country: dk
  • Mechanical engineer gone rogue
Re: Flir E4 Thermal imaging camera teardown
« Reply #501 on: November 03, 2013, 11:15:30 AM »
No - it reads all files in the config.d for .cfg and factory.d for .rsc files
Each file must have a valid CRC otherwise it is ignored.

I'm assuming, but not 100% confirmed, that it reads files in alphabetical order, and options in later files override any in earlier files.
.rsc files have CRC32 and are portable between units
.cfg files have CRC01 and include the unit serial number and so are specific to a particular camera.

So the rndis.rsc you showed has the CRC32:
Code: [Select]
# CRC32 d51f0c78
and the zlast_RNDIS.rsc from the iX firmware file:
Code: [Select]
# CRC32 d51f0c78
That must mean  :-/O on the filename  :-//

Any brave volunteer with an i3?
« Last Edit: November 03, 2013, 11:17:51 AM by Wann »
Mechanical engineer gone rogue

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 4711
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #502 on: November 03, 2013, 11:20:24 AM »
Actually I vaguely recall that the  i3 already has a known way to do rndis from the keypad - take a look a few pages back.
Mike's Electric Stuff: High voltage, vintage electronics, electrical curiosities
Day Job: UFOs, LEDs etc.
Versatronics & other low-end pick & place forum

Offline Wann

  • Supporter
  • ****
  • Posts: 34
  • Country: dk
  • Mechanical engineer gone rogue
Re: Flir E4 Thermal imaging camera teardown
« Reply #503 on: November 03, 2013, 11:23:54 AM »
Actually I vaguely recall that the  i3 already has a known way to do rndis from the keypad - take a look a few pages back.

Yes you're right.
Mechanical engineer gone rogue

Offline olsenn

  • Frequent Contributor
  • **
  • Posts: 994
Re: Flir E4 Thermal imaging camera teardown
« Reply #504 on: November 03, 2013, 12:22:16 PM »
Can someone post a screenshot from the E4 (prior to applying the hack) and the same shot after the hack has been applied? I'd like to see the difference an increase in resolution makes.

Also, since I noticed that there's been a lot of talk about firmware and crc checks etc. has there been any new progress on this hack? I am under the impression that the E4 can now become an E8 without opening it up?

Offline Wann

  • Supporter
  • ****
  • Posts: 34
  • Country: dk
  • Mechanical engineer gone rogue
Re: Flir E4 Thermal imaging camera teardown
« Reply #505 on: November 03, 2013, 01:08:06 PM »
Can someone post a screenshot from the E4 (prior to applying the hack) and the same shot after the hack has been applied? I'd like to see the difference an increase in resolution makes.

Maybe I can take some in the morning.

Also, since I noticed that there's been a lot of talk about firmware and crc checks etc. has there been any new progress on this hack? I am under the impression that the E4 can now become an E8 without opening it up?

See post #524  :P
Mechanical engineer gone rogue

Offline nova1200

  • Contributor
  • Posts: 7
  • Country: us
Re: Flir E4 Thermal imaging camera teardown
« Reply #506 on: November 03, 2013, 01:36:39 PM »
It works!! Fantastic sleuthing everyone!
Here is a pair of images, not quite from the same perspective, but close. Before:

After:


This was on a just-purchased E4 (another sales commission for Mike) with firmware 1.18.7.

Online kaz911

  • Frequent Contributor
  • **
  • Posts: 269
  • Country: ae
Re: Flir E4 Thermal imaging camera teardown
« Reply #507 on: November 03, 2013, 02:52:21 PM »
here is a link to the 1.18.7 firmware http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_ex_pn639_v1.18.7_update_pack.zip

can someone test if you can downgrade? (Only do if you have the later firmware of course) :)

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 4711
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #508 on: November 03, 2013, 08:22:07 PM »
Earlier hack works 1.18.7 - latest hack uses same file - only difference is how the file gets there, so no reason to think it won't work.
Mike's Electric Stuff: High voltage, vintage electronics, electrical curiosities
Day Job: UFOs, LEDs etc.
Versatronics & other low-end pick & place forum

Offline Zoltan von Negrow

  • Contributor
  • Posts: 13
  • Country: cz
Re: Flir E4 Thermal imaging camera teardown
« Reply #509 on: November 03, 2013, 09:29:49 PM »


At a PC command prompt, run

  CRC01 E8.cfg (on the edited file)

This will display a line in the form
# CRC01 xxxxxxxx



I canĀ“t make crc in cmd, how exactly i have to make this?


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf