Flir E4 Thermal imaging camera teardown

[mikeselectricstuff]

I called PASS in the UK today, which is where I got my E4, to place an order for some Fluke gear.
The salesman got chatting about the E4 and the hack and said "you were lucky, the next lot are going to be hack proof" 

..to which the answer would be "well good luck with selling those then..."

Yes I was very tempted!

Would be interesting if dealers started getting loads of orders specifying that the order is contingent on the earlier firmware version...

Certainly anyone ordering now should make it clear that only FW1.19.8 or earlier is acceptable as a condition of order.

[mrflibble]

The salesman got chatting about the E4 and the hack and said "you were lucky, the next lot are going to be hack proof" 

He probably meant to say "we were lucky the current lot is not hack proof". An easy mistake to make, especially when you're still feeling a bit giddy after reading the recent sales report.

[Taucher]

Btw - did anybody have success in taking a look into an Exx series model yet?
I'd really love to know what wlan/bt hardware is beeing used there - and where it is connected

[ixfd64]

I hope the guy was only joking about the newer E4's being hack-proof.

Ah well, even if FLIR does make the E4 "hack-proof," I'm sure there will be other ways to hack it.

[MrSquirrel]

Btw - did anybody have success in taking a look into an Exx series model yet?
I'd really love to know what wlan/bt hardware is beeing used there - and where it is connected

I can probably help with an E8 but it all hinges on the E4 i've got on order being co-operative or not.

Has anyone looked further into the role the I2C EEPROM is playing? Mike's earlier comments on it were interesting. It looks like one of you guys with an already co-operative E4 could explore the bus with i2c.exe.

[pmcouto]

Btw - did anybody have success in taking a look into an Exx series model yet?
I'd really love to know what wlan/bt hardware is beeing used there - and where it is connected

Hi Taucher,

When FLIR launched Ex series, they also launched a new version of Exx series, with new features (ex. MSX), new firmware and a slightly different “look”.
I heard some rumors about this new Exx version hardware: Same base hardware as Ex plus WiFi/BT module and digitizer (touch screen) interface (this may be the unpopulated connector on the PCB, seen in Mike’s teardown).
Please note this is only a rumor – I didn’t have the opportunity to see the new Exx “guts” yet…

If the rumor is true, it may be possible to add some interesting features to Ex series. 

Exx series are 60 Hz TICs.
However, the lens is significantly larger than Ex, so probably Ex will not have an acceptable performance at 60 Hz, if (or should I say when?  ) a hack becomes available…

Regards,
Pedro   

[G0HZU]

But Flir tools doesn't seem to be very useful for anything so not a big deal.

Flir tools does have an annoying user interface (to me) but I do find it fairly useful. You can post process the images to do things like change the size of the HOT/COLD search area. Also it looks like it upscales the images to a higher pixel count making them look a bit more pleasing when blown up.

But I did wonder if Flir Tools could auto update itself via the web and then do a sneaky patch over USB to put the camera back to 80x60.

[Psi]

Ah well, even if FLIR does make the E4 "hack-proof," I'm sure there will be other ways to hack it.

Unsoldering the flash chip and mounting it under a WinCE install, (as talked about a while back), should be fairly simple and allow the new firmware to be hacked.
Just wont be able to hack it without opening the case and some technical skill.

Assuming someone doesn't figure out a new usb based hack of course

[PA0PBZ]

since there will still be a way to update the firmware the easiest thing would be to have the 1.18 firmware look like 1.22 and 'update' the camera with that.

[Wann]

since there will still be a way to update the firmware the easiest thing would be to have the 1.18 firmware look like 1.22 and 'update' the camera with that.

Shhhhhh 

[mrflibble]

Btw - did anybody have success in taking a look into an Exx series model yet?
I'd really love to know what wlan/bt hardware is beeing used there - and where it is connected

I can probably help with an E8 but it all hinges on the E4 i've got on order being co-operative or not.

Has anyone looked further into the role the I2C EEPROM is playing? Mike's earlier comments on it were interesting. It looks like one of you guys with an already co-operative E4 could explore the bus with i2c.exe.

Already tried that. i2c.exe doesn't get you too all that much interesting info (lots of 0xff). First passive snooping on the bus during startup and when required some active reading/writing might get more results.

[MrSquirrel]

If the rumor is true, it may be possible to add some interesting features to Ex series. 

I would raise that from rumor to very likely, but perhaps a different FPGA? Take a look at the Exx series firmware for proof and have a dig around in the .fif files.

The Exx firmware also has additional FPGA .bin files fpga_c4_55.bin & fpga_c55.bin. Looks like it went through a hardware change too, as those seperate files relate to different revisions of the Exx camera. Also, c4_55 and c_55 look like they might relate to some of Altera's own part codes (i'm not an FPGA guy)?

Many of the error strings in the Ex firmware reference features that are only available on the Exx.

[0xdeadbeef]

I noticed that after charging, a ghost image of the battery symbol that's shown during loading is still visible when the camera is active.
Does this happen only for me?
I tried stuff like switching to digital camera mode and watching a white wall hoping the "burnt in" image would go away, but no success so far.

[mrflibble]

If the rumor is true, it may be possible to add some interesting features to Ex series. 

I would raise that from rumor to very likely, but perhaps a different FPGA? Take a look at the Exx series firmware for proof and have a dig around in the .fif files.

The Exx firmware also has additional FPGA .bin files fpga_c4_55.bin & fpga_c55.bin. Looks like it went through a hardware change too, as those seperate files relate to different revisions of the Exx camera. Also, c4_55 and c_55 look like they might relate to some of Altera's own part codes (i'm not an FPGA guy)?

Many of the error strings in the Ex firmware reference features that are only available on the Exx.

Been there done that. fpga.bin sizes suggest similar complexity, if not downright the exact same fpga device. IIRC at least one of the bit files for Exx is slightly smaller than for the Ex. As in just might be that at least one Exx board revision uses the same fpga device as for Ex.

*checks*
./flir_ex_pn639_v1.18.7/Z3comb_v1.18.7/FlashBFS/system/fpga.bin 626970 bytes
./flir_exx_pn490_v2.23.14/E2comb_v2.23.14/FlashFS/system/fpga.bin 592029 bytes

I'd be real interested in 1) knowing the fpga device on the Exx, and 2) some macro shots of the pcb.

Hell, while we are speculating ... the first Exx series + the date on that sensor die in Mike's vid. Similarities anyone? Form factor of Exx vs Ex? It looks pretty damn likely that the Ex is an evolution of the Exx design. Downgrade here and there, and introduce it in a lower price bracket.

And as pointed out, appcore.exe similarities are also all over the place. As for several of the other .exe files (gethwtype.exe unsurprisingly).

So time for someone to pop open an Exx and take a vid or some pics. 

The Exx firmware also has additional FPGA .bin files fpga_c4_55.bin & fpga_c55.bin. Looks like it went through a hardware change too, as those seperate files relate to different revisions of the Exx camera. Also, c4_55 and c_55 look like they might relate to some of Altera's own part codes (i'm not an FPGA guy)?

Yup, that looks to be the case. If only because if you check the flir support docs, there are 3 versions of the Exx listed. And there are 3 fpga*.bin files.

[mrflibble]

I noticed that after charging, a ghost image of the battery symbol that's shown during loading is still visible when the camera is active.
Does this happen only for me?
I tried stuff like switching to digital camera mode and watching a white wall hoping the "burnt in" image would go away, but no success so far.

Nope, you're not the only one. It was reported earlier on, and I confirmed it as well.

After that I think I made a fix for that. I still have to properly test it. Too much other stuff.

[Pinkus]

Is there a way to change the written EXIF information in the firmware? I would like the camera to leave/change the serial number which is otherwise written to with each picture and also to change the written E4 to E8 at the EXIF camera model place.
Maybe somebody already stumbled on it.

P.S. Of course it can be changed later with some tools but best would be to let the camera write the wanted information right away thus eliminating any later file procession.

[bernroth]

I just created a makefile to compile the crc01 tool on OSX and Linux with gcc (g++)
I am thinking about extending the source code in order to append serial number (ID) and checksum (CRC01) automatically to a raw settings file.
The file will then be correct with CRLF etc.. and few risk to make something wrong.
This would ease the process a lot as I have seen many questions about formatting the file.

Pls let me know you opinions

[mrflibble]

Didn't Taucher already make a patch like that for windoze? And in linux country I've got a bash script lying around for ages now to do things automatically.. But I figured it was a bit pointless what with rndis, chickens, eggs, and relative linux/windows clue distributions.

But if you are about to flush time into it, might as well save you some time at least for the *nix side of things

Make sure you have the todos/fromdos tools. You want to have those anyways.

Code: [Select]

apt-get install tofrodos

Make sure the E4 is attached as mass storage device and mounted somewhere. See the attached tgz, and run autohack.sh. Well, almost autohack anyways, since I didn't manage to get rndis working at that time. It spits out a .fif ready to be used with your serial.

I'm pretty sure it works, since I used this to hack mine.


PS: It's a tgz, so just unpack with tar xvzf e4_autohack.tgz.zip. Silly forum limitations on attachment filenames...
PPS: It tries to automatically find the right mountpoint. If you don't like a script running a find like that, you're opinionated enough to provide the right filename by hand.

[0xdeadbeef]

Call me stupid, but while in can connect to FTP in RNDIS mode, the ftp server refuses to accept "3lvig" as password for the user "root" or "flir".
I tried FileZilla, SmartFTP and the command line FTP client.
The weird thing is that I managed once to login with the command line FTP client, then tried SmartFTP and since then, it doesn't work anymore at all.
I rebooted my PC serveral times, switched off the E4, removed the battery, switched USB modes etc.
The outcome is now always the same: root/3lvig or flir/3lvig are refused for FTP and also for the web frontend.
What the heck is the trick there???

[mrflibble]

The trick is obviously to use winscp as ftp client because winscp doesn't suck, but mostly ..... use flir/3vlig (aka not what you used).

[mikeselectricstuff]

Btw - did anybody have success in taking a look into an Exx series model yet?
I'd really love to know what wlan/bt hardware is beeing used there - and where it is connected

I can probably help with an E8 but it all hinges on the E4 i've got on order being co-operative or not.

Has anyone looked further into the role the I2C EEPROM is playing? Mike's earlier comments on it were interesting. It looks like one of you guys with an already co-operative E4 could explore the bus with i2c.exe.

I do have some dumps of I2C traffic but stopped looking once I realised that the config doesn't appear to come from there, and that if you change the resolution figure it gets changed back.
My best guess is the eeprom contains the serial number, so it isn't lost of the flash ever gets reinitialised,  and is also used temporarily as a way to communicate the resolution setting back from the application environment to either an early part of the boot process,  or the FPGA.

[0xdeadbeef]

The trick is obviously to use winscp as ftp client because winscp doesn't suck, but mostly ..... use flir/3vlig (aka not what you used).

Damn it, "3lvig" is given several times in this thread. So obviously the the one time it worked I misspelled it and by chance got the correct "3vlig" spelling this way.
Thanks, I was about to get crazy.

[olsenn]

My E4 arrived today. For those of you who are keeping track, here's my unit information:

                                Serial: 63905XXX
               Calibration Date: 10/23/2013
                          Firmware: 1.18.8

[mrflibble]

Damn it, "3lvig" is given several times in this thread. So obviously the the one time it worked I misspelled it and by chance got the correct "3vlig" spelling this way.
Thanks, I was about to get crazy.

Easy enough to remember, since the software dudes are Swedish, and trevlig is swedish for positive things.

[0xdeadbeef]

For those who don't speak Swedish though, 3vlig and 3lvig both sound plausible
Anyway, I exhanged the battery_frame.bmp and flash_graybackground.bmp with much darker versions now. Hope this helps.
At least the ghost image of the battery symbol has nearly disappeared now...