Flir E4 Thermal imaging camera teardown

[RAWebb]

Another n00b here. Stumbled across the notorious "hack" reference in the review at tequipment.net and followed the hint over to here. I'm one of the "it would be nice to check the hot water heater's insulation but $$$, it would be nice to check the ducting but $$$, etc. etc." gang. I'm definitely a sale that FLIR wouldn't have made if the mod hadn't been available.

The particulars:
FLIR E4 V 1.1, 639128XX 2014-01-21
Cal date 2014-01-22, Estonia
Firmware 1.19.8 and one of the last if not THE last that tequipment.net had from their shipment of 55.

I've only made the resolution mod, so far (RNDIS + FTP to the appropriate config.d), with the e8.cfg built using EzCRC01 (as my tgnyp si dab smoetmies).

[echen1024]

Even with all these sales being made, I contacted a distributor and this is the reply

Secondly, I am not going to facilitate your hacking of units.

[pomonabill221]

Even with all these sales being made, I contacted a distributor and this is the reply

Secondly, I am not going to facilitate your hacking of units.

Well boo hoo! 

[ixfd64]

Even with all these sales being made, I contacted a distributor and this is the reply

Secondly, I am not going to facilitate your hacking of units.

It's all for political reasons. Officially endorsing the hack probably isn't going to sit very well with FLIR.

[mrflibble]

Even with all these sales being made, I contacted a distributor and this is the reply

Secondly, I am not going to facilitate your hacking of units.

Well, what did you expect a dealer to tell you regarding hacking of units? Unofficially they might like the extra sales, but you can hardly expect them to support hacking on the record. Presumably because they would like to stay a distributor for Flir.

[Taucher]

Just a short info:
Total commander on the E4... http://tcce.s3.amazonaws.com/b3/ce2/cecmd.arm.cab - this one works on the E4 (I selected the beta version)

Code: [Select]

380.416 cecmd.exe
 104.960 ftp.tfx
  13.312 LAN.tfx
  32.256 registry.tfx

Did you just use wceload to install that cab?

Actually I just unzip the cab (7zip or expand.exe) - then rename the files by educated guess (size, name artefacts) or a quick peek into the .000 file.
Unfortunately the TFX files don't seem to work (registry.tfx seems to be just a renamed .exe) - all you might want is the cecmd.exe

[nersut]

FOUND A WORKING VNC SOLUTION!
http://efonvnc.sourceforge.net/ (big THX!)

Tested with Ultavnc as client on PC.
Note: before you can connect you'll need to run vncconfig and disable PW auth (can be done with the cursor keys).
Then start winvnc via telnet and connect to your E4 over VNC 

Note: The IR-Image will not be displayed as it's an overlay/alpha-key - it shows as BLACK - that's ok

EDIT: Added more screenshots - using windows\control.exe one can rename the camera to a more neutral name

Hi Taucher

I also tried the VNC connection. 


Is it possible to kill & replace the appcore.exe with a modified version without completely crashing the camera/making it useless?
This is to test hex value for 30Hz... And of course be able to restore the original appcore.exe file after testing.

I am referring to the text/quote below.

Maybe it is a language thing, but I am confused right now:
I thought, modifing the 4 bytes at 0x001016ec from "05 00 a0 e1" to "01 00 a0 e3" will enable 30Hz but in your posting above you say 100ms between each frame = ~9 Hz. Did I miss something or did I understood something wrong? So no 30Hz by changing appcore.exe?

[Taucher]

Hi Taucher

I also tried the VNC connection. 

Is it possible to kill & replace the appcore.exe with a modified version without completely crashing the camera/making it useless?
This is to test hex value for 30Hz... And of course be able to restore the original appcore.exe file after testing.

Read up on the thread, I tried it and it just changed the reported rate to be 30Hz, but not the actual Hz rate (checked with high-speed video).

[nersut]

Hi Taucher

I also tried the VNC connection. 

Is it possible to kill & replace the appcore.exe with a modified version without completely crashing the camera/making it useless?
This is to test hex value for 30Hz... And of course be able to restore the original appcore.exe file after testing.

Read up on the thread, I tried it and it just changed the reported rate to be 30Hz, but not the actual Hz rate (checked with high-speed video).

Okey, my bad. 
Thanks anyway.

[Chanc3]

@Dave, great to see some alternative software out there, but unfortunately it crashes when I try editing any thermograms from our Flir SC640.

Yes, I did it with my E4, so only tested on E4 images. You can send me your image and I will try to get it work.

As attached!

Great stuff, is this implemented in the new version?
Well, fixed for you.

[daves]

Great stuff, is this implemented in the new version?

Sorry, some troubles during release. Try now, should be fine.

[Pauloven]

Hello.

I arrived late to this party.>> I talked to an UK seller and told  my that only 1.2 fw was available.

I talked today with an Spanish reseller and told my that the units they had in stock had to be sent back to Flir to correct a security issue, I talked about that security issue... They still had one in Madrid but they can not sell it but sent it back to flir. So I believe the only chance for people like me will be a downgrade "feature" to appear.  Firmware downgrading, sounds like PSP times... But this time seems more legit.

[-TPi-]

I got my E4 and already made resolution upgrade modification. It works fine THANKS A LOT!

[Fraser]

Those hoping for a downgrade path need to consider that I was advised by FLIR that my E4 1.19.8 needs to go back to them for upgrade to 1.21.0 ! This would suggest that something beyond a normal firmware upgrade is in play. That difference may make it very difficuly to deploy an older firmware on the V1.1L hardware platform.

I know FLIR dropped the ball with their previously poor configuration security, but if they are anything like the company I believe them to be, they will have had a meeting to draw up a Vulnerabilitiy assessment and Risk list, followed by a risk treatment plan. The result will be a well thought through series of changes to inhibit attempts to 'hack' the unit by any simple means. Closed Case hacking would be high on my list of vulnerabilites that will have been addressed.

Maybe there would be the option to transplant a full OS and 1.19.8 firmware image onto a new 1.21.0 platform, but that may also raise the issue of hard coded serial number checking and CRC checksums.

EDIT: Some comment on hacking removed as of no consequence here.

[Taucher]

Just a quick notice to everybody using FTP to back up stuff:

use root / 3vlig as credentials - the flir user won't see files with root only permissions!

I've just wrote an exe (thanks to http://read.pudn.com/downloads59/sourcecode/embed/207018/WinsockComm/pwinreg.h__.htm and http://geekswithblogs.net/BruceEitman/archive/2008/12/23/windows-ce-save-and-restore-the-registry.aspx ) to dump the whole Ex registry into a file (binary) and the file is not visible by FTP unless logged in as root.

[Taucher]

... I was advised by FLIR that my E4 1.19.8 needs to go back to them for upgrade to 1.21.0 !...

Well, will you send it in for that great "upgrade"?

[Fraser]

No Way !

[Taucher]

Hrhr, guessed so

[echen1024]

Even with all these sales being made, I contacted a distributor and this is the reply

Secondly, I am not going to facilitate your hacking of units.

Well, what did you expect a dealer to tell you regarding hacking of units? Unofficially they might like the extra sales, but you can hardly expect them to support hacking on the record. Presumably because they would like to stay a distributor for Flir.

I simply asked when they received these units.

[Galaxyrise]

I simply asked when they received these units.

That was the approach I took as well.  Bought mine from Zoro Tools over the phone on 2/17, and after some digging the fellow said they were received in early January.  At the time, they still had a number in stock.  Their return policy is pretty good, so I took the chance.  Received it today, and it's 1.19.8

I'm another tick in the "wasn't even thinking about buying a TIC until this" column; thank you everyone!

[pomonabill221]

I simply asked when they received these units.

That was the approach I took as well.  Bought mine from Zoro Tools over the phone on 2/17, and after some digging the fellow said they were received in early January.  At the time, they still had a number in stock.  Their return policy is pretty good, so I took the chance.  Received it today, and it's 1.19.8

I'm another tick in the "wasn't even thinking about buying a TIC until this" column; thank you everyone!

And their price is good also!  Wonder if they are still in stock as they seem to go FAST?

[ixfd64]

Some users on a forum for home inspectors just apparently became aware of this hack: http://www.nachi.org/forum/f58/problems-flir-imager-88918

As usual, people are debating whether the hack is considered "stealing." Either way, it's probably a moot point as FLIR has already patched the hack in the latest firmware. That is, until someone develops a new hack.

[Z-mann]

Hey Guys,

here my short report:
Flir E4 bought at conrad (Austria, not Australia ) online store.
S/N: 6391 47XX
Firmware: 1.21.0
HW: 1.1L
Cal. date: 14. Feb. 2014

This unit will go back, sadly.... 

Greetings Mr. Z

###Modified: Added cal. date

[Fraser]

Calibration date please. It's on a card in the box.

Cheers

Aurora

[caudex]

Looks like the party is over....
Phew, Luckily I caved and bought my E4 in Mid Jan....

Looks like the price of E4 with old firmware will soar on eBay lol.....

I am guessing they might have chnaged some of the hardware to make the memory LOCKED and only changable via their own software which uses some sort of encryption key. Might be back to the times where you need to solder on a mod chip....