Flir E4 Thermal imaging camera teardown

[heavybarrel]

Agreed! Sadly there is no good way to prevent it. Those of us here have only noticed the case at hand, there are many more that exactly follow suit! I formally apologize if i threw this thread off track as that was not my intention. If it ends here, so be it, but i sincerely hope that's not the case! If i can help out in any way i am more than willing!!

[emptech]

Uski:

You mentioned you didn't have a device to check the bluetooth with.  When I first got my camera I
had no idea as to how the camera communicated with other devices, FLIR's documention sucked at
the time, they have improved it.  If you have a bluetooth headset, you can link to it, that's how you
add voice annotations to your pictures.  That should tell you the bluetooth is working or not.

By the way, since mine was born an e40, which has bluetooth and wifi, does the e30 not have those
features?  As we have learned, it wouldn't make since for FLIR to make different boards for each of
the eXX models, so you would think all versions of the series would have the same chips.

Jim

Hi,

For those of you with an E30(bx) (not E4) PN 40xxx-xxxx with firmware 2.23.14, you can add Bluetooth by :
- Adding a cheap USB bluetooth dongle (there's the bluetooth USB driver in the OS), see the attached picture
- Modify the \FlashFS\system\services.d\config.d\conf.cfg to enable Bluetooth :

--------------------
#
# Appservices wlan configuration
#
.caps entry
.caps.config entry
.caps.config.name text "srvs E60"
.caps.config.revision text "0.10"
.caps.config.wlan entry
.caps.config.wlan.enabled bool true
.caps.config.bluetooth entry
.caps.config.bluetooth.enabled bool true
# ID 49xxxxxx
# CRC01 xxxxxxxx
--------------------

And voila it should work. I say it should because I don't have any MeterLink compatible device to test. But it shows the Bluetooth icon, allows me to turn it off/on and the LED pattern on the Bluetooth dongle changes accordingly, and I can start a scan.
The Bluetooth feature allows you to link some MeterLink compatible meters to add data directly into the IR images OSD (current, humidity, ...). http://www.extech.com/meterlink/

About Wifi ? Well I found out that the chipset used must be 88W8688 (it's a combination bluetooth/wifi chip).
The bad news is that it's SDIO only, which means a module most be soldered onto the PCB. I didn't open the camera yet but I suspect the module is not there (or if it's there it's disabled either by hardware of software).

If I have an opportunity to open the camera, I'll try to see if the module is there and if no, I'll try to find where to buy it.
I think it's extremely likely that FLIR is using an off the shelf module.

---

Another option is to add the driver of a USB Wifi dongle. Several manufacturers publish compatible drivers. But I'm not familiar with WinCE enough to do that. Can anyone help me out with this ? Thanks.

[all_repair]

I think FLIR is much wiser, and can see through the cost and benefits.  It maybe some competitors throwing a spanner here. 

BUT this "1000 dollar camera sold on ebay for "eeehhh mayyyy beee  too much" = No loss to FLIR" is disturbing.  It shall depend on the margin of the set.  Appearing on ebay already not a good thing for FLIR, even if it of little margin for the seller.  Because it makes FLIR very difficult to answer, and to justify, to E6 and E8 buyers.  And if the margin is huge, the buyers are those who may have bought the more expensive models.

Enjoy the hack quietly :-) Don't force the hands of FLIR by pushing them into a corner, and likely they would not mind free ideas and improvement coming out from here, and more sales from here. 

[Short Circuit]

...
Appended is a ZIP file with the tools (source code plus Windows binaries)
...

Another happy E4 1.1L / 1.21 owner! 

[Gallymimus]

OK! First off, just signed up after watching this forum (this thread in particular) for quite some time now! Id like to add my 2 and a half cents to the mix. Id like to thank all the brilliant minds here who have created the "patch" for the e4. I never would have bought one if it wasn't for their hard work, the spoils of which i have enjoyed very much, again, thanks guys!!!!! Now i feel obligated to put a bit of calm to the panic. Apologies if you gents arent getting the same vibe that i am at the moment. Now quite a few people feel that there are sensitive issues at play here. That is surely not the case, i will try to get to most of them and i will do my best not to strike any nerves... In regard to the issue of FLIR being "taken" by those of us who are enjoying the extra features enabled by this "patch", If FLIR was paying close attention..... what they really aught to do is add more complex features to the higher line cameras and let the good community "have this one" on good faith. Afterall, i dont think anyone here can rightfully say they haven't learned something here. Besides, if you buy a brand new Chevy does the manufacturer get upset if you paint it a new color? Do they get upset if you rip out the motor and put in one that performs better? More appropriate.... Do the manufacturers get upset when you upgrade the ram, hard disk, graphics card, operating system, on your computer?? No, they don't! This is exactly the case here, users of the hardware have merely found a way to  "unlock included hardware features." If the good people at FLIR didn't want or intend this to happen, i say "oops!"  Do you think the folks at the Chevy dealership will void their manufacturers warranty if you have a new paint color, different set of rims and tires, and a new stereo? I think not! FLIR should probably at this point call it a wash because there have been "ABSOLUTELY NO LAWS BROKEN HERE!!!" International law states that it is the manufacturers position to provide a product that can not be used for harmful or destructive purposes, i highly doubt any of the cameras in the e series could be used for such unless you used one to hit yourself on the head. Even then, they are actually made pretty soft and comfortable!!
Lets look at the sales facts for a second shall we!
1000 dollar camera upgraded to a 6000 dollar camera purchased by someone who can afford 1000 = no loss to FLIR
1000 dollar camera sold on ebay for "eeehhh mayyyy beee  too much" = No loss to FLIR
1000 dollar camera sold by FLIR for 1000 = no loss to FLIR
1000 dollar camera sold by FLIR without the patch = no loss to FLIR
6000 dollar camera sold by FLIR that people wouldn't normally buy or be able to afford = no real loss to FLIR taking into account sales to business that would normally not care about the price (right off!! = freebie)
We should remember that these aren't available at your local wal mart, all of these cameras come from FLIR distributers,  there is no money being lost here, only gained. With that said, its ALL LEGAL fellas!!! Now if someone is advertising a FLIR e4 as an e8, yes that's a problem. If it is advertised as what it actually is.... buyer makes the choice.
Having laid out my position on the matter i look forward to the rest of the ee's and the like here keeping up the good work!!

Cheers to all of us!!

Another interpretation is that it is stealing.  They didn't want you to have it, and you took it anyway.

FLIR may not make much money on the E4, it could be a loss leader, more likely, the margin is small enough that they aren't a very viable business without the higher end sales.  Hacking efforts devalue their higher end units no matter what you say or think about it. 

Would I hack one of these?  Sure I would?  But I'm a bad person. At least I can admit I am stealing, cheating, and committing an immoral act that is harming others.  Maybe not illegal, but definitely wrong.  Rationalizing the hack is stupid and a waste of peoples time.  Explaining how FLIR should WANT to be violated in this way is simply embarrassing.

You can flame me and argue all you want, but if you can't tell me that these actions make the employees of FLIR feel good and happy about these efforts then you are doing harm to those employees, harming the business, and probably getting some poor engineers fired or at least in a lot of trouble.

Lucky for me I'm a bad person and a hypocrite!

Now, let's see 1.22 fully cracked open!!!

[tsg]

all new E4 stock ships with 1.22
I received mine yesterday. I  was expecting 1.21
It will be going back Friday/Monday as I am away till then.
Stuck at airport. Flight delayed 2h

[aargee]

I think it's really interesting how Flir have managed (probably accidentally) to have a great forum as this to do a portion of their R&D for them. Not only teaching them how to (try and) hack proof their products but also the user information on applying ideas and schemes to the software, a great resource on the likes/dislikes of the operational side of things for the marketing department, etc.

This could actually be a good business plan... How many R&D Krona saved over how many *real* E5-8 sales lost.

[Rainer]

@tsg: Why didn´t do some "engineering" on the 1.22? I think, the new software is not for kicking us off from their system or hack-proof or anything other like this. There are some minor bugs in 1.21, like the rotating display with my TIC.


If Flir use this thread to get new ideas on their products: The most useful option, they should support out of the box is the manual scale setting. All other features of the hacked TIC are great, but when i didn´n want to hack, the manual scaling makes the difference. On the other side, some extra Palettes and the zoom-feature can improve the E8.

@Flirs business plans, when they didn´t want to sold out the E8-hardware to the price of E4, why did they do that? Nobody can force them, to sold a TIC without profit or with a "negative profit". If they do so, its their decision.

[tomas123]

all new E4 stock ships with 1.22
I  was expecting 1.21
It will be going back Friday/Monday as I am away till then.

The only difference between 1.21 and 1.22 is the binary file \FlashBFS\system\fpga.bin
FW 1.22 is not a countermeasure against new hack. Flir can't react so quickly.

I think, they forgot something, like reading the hardware version (=resolution) from EEPROM.
There is a real change, that this file can be changed with Version 1.21

... or Flir changed additional the hardware and fixed the resolution on motherboard
That would be my low cost solution - a solder strap under the FPGA package

Don't forget, the market knew from the upgradable FLIR TICs since 4 years and nobody saled until now Flir++ TICs.

http://chipworks.force.com/catalog/ProductDetails?sku=FLI-S0185582&viewState=DetailView
Publish Date: Nov-09

march 2010, see page 3 in  www.i-micronews.com/upload/Micronews/Micronews_90.pdf

Code: [Select]

Extech i5 by FLIR
The camera is advertized to have an 80 x 80 pixel image, and a sensitivity of 0.1oC
(Chipworks found a 240 x 240 pixel sensor in the camera that we tore down).

the flir hack is not new, but nobody published the hack yet (avoid closing the vulnerability)
I hacked my Flir E40 a year ago, after I read something about the the Flir i3/i5/i7 sensor (documents from year 2010)

The Flir i3/i5/i7 sensor size is 320x240 pixel
see http://www.i-micronews.com/reports/FLIR-ISC0601B-Micro-bolometer/1/297/

and page 3 in  www.i-micronews.com/upload/Micronews/Micronews_90.pdf

nice blog http://blog.naver.com/PostView.nhn?blogId=sgyee&logNo=10082558135


http://www.systemplus.fr/wp-content/uploads/2013/04/MEMSTrends_2012_10_N12_systemplus.pdf

The sensor used in the i3 has 20 times more pixels than necessary, and four times more pixels than the i7. Incidentally, the same sensor can be used in more expensive cameras.
...
Each pixel is composed of a thin resistance in vanadium oxide (VOx) covered with an absorber in silicon oxide which absorbs the infrared ray. The temperature of the SiO2 layer is proportional to the temperature of the IR radiation, and the value of the resistance VOx is proportional to the temperature of the absorber. A measurement of the resistance provides the temperature.

[Nemonic]

@tsg Where did you buy from? Was it someone that that says "Direct from Flir" ?

I am not sure if these guys make orders from FLIR directly/warehouse while others keep their own stock for a discount.

I'll have my E4 within 2 hours so will know for certain by then. I shall try the hack and see how it goes even if i have a 1.22 unit.

@ds I have created a GUI editor that allows direct opening/editing/saving of the cfc file. Suid is extracted from the file with your FTool source ported to C# and i've also ported the crc03 source so its self contained project. I would like to attach prominent attribution information to yourself and the developer of the crc03 module. Would you have any information on the crc03 developer and yourself you would like me to include before i upload it? I would also like to add my .exe + *.cs source code to your zip and upload that so all tools in one zip, would that be ok?

On save i just trim any end new lines, empty lines, CRC03 lines and insert the new CRC03 line. The saved files appear to be identical with files processed by the command line tools, but will test it on my own camera shortly to confirm it works.

[tom66]

I doubt Flir are making a loss on the E4.
With most products like this, you might expect to sell 20,000 units total.
So your NREs are quite significant, on the sensor and on the unit itself.

Selling 10 E4s probably just about makes up for the profit on E8s, but they may not see this. They'll still sell E8s to the industry, but many of the smaller thermography businesses might use hacked E4s (though maybe calibration is important?)

The FPGA at £45 is pricey. The SOC probably costs £15. The sensor is probably most significant.

Looking at Mike's teardown though, it's remarkably simple. I'm guessing the micromachined array is the expensive part, but I don't know how much that actually costs to make.  I'd take a punt though that it costs near the same as an 80x60 sensor of the same size.

If Flir can afford to stick a 320x240 sensor in each camera, they aren't losing money.

[ds]

@ Nemonic

Great that your GUI editor is already done.

I am fine if you leave my original source code in the full
package and a reference to the Blog message where I
released it (maybe in the Readme).

I have adjusted the original CRC01 code of tnt which was
posted early somewhere in the thread to support the new
CRC03. I can't speak for tnt but I guess its OK if the complete
source code is included because the CRC module contains a
copyright notice.  To be sure you should ask him.

[tsg]

@ Rainer

done nothing to it: set it to RNDIS mode via menu>Hold and connected on ftp to "Backup" the filesystem and put it back in the box.
I have another E4 1.19.8 which I am happy to play with. been busy with work lately..

[Nemonic]

@ds Thanks, i'll try post something later with the info added.

In other news i can confirm new E4's are shipping with 1.22 already install.

I can also confirm the tools provided by ds also work on the 1.22 versions.

Update:
These pictures aren't doing it justice, i will upload some better ones later.

[Sofia]

Good day. I want to buy E4 1.21.
I do not understand the instructions, "unprotect" the protected configuration file:

Where can I find the file conf.cfc? The camera via FTP?

There is an error in the "cfg" txt? - The output looks like this:

   Add the Following line to the. Cfg file:
   # CRC03 a78cd4f5

I do not code - CRC03 a78cd4f5-insert into conf_plain.txt?

Thank Sofia

[mrflibble]

Good day. I want to buy E4 1.21.
I do not understand the instructions, "unprotect" the protected configuration file:

Where can I find the file conf.cfc? The camera via FTP?

There is an error in the "cfg" txt? - The output looks like this:

   Add the Following line to the. Cfg file:
   # CRC03 a78cd4f5

I do not code - CRC03 a78cd4f5-insert into conf_plain.txt?

Thank Sofia

Best send a PM to user Jakamil. No doubt by now he will have written a guide on this to benefit the group.

[Sofia]

Good day. I want to buy E4 1.21.
I do not understand the instructions, "unprotect" the protected configuration file:

Where can I find the file conf.cfc? The camera via FTP?

There is an error in the "cfg" txt? - The output looks like this:

   Add the Following line to the. Cfg file:
   # CRC03 a78cd4f5

I do not code - CRC03 a78cd4f5-insert into conf_plain.txt?

Thank Sofia

Best send a PM to user Jakamil. No doubt by now he will have written a guide on this to benefit the group.

Thank you for your help
This help me, but it did not help

[ds]

I received the configuration files from an E4 with
firmware 1.22 and can confirm that the protection
mechanism and CRC03 are the same as in version 1.21.

And as Nemonic wrote, the resolution upgrade seem
to work in V 1.22 too.

[ixfd64]

all new E4 stock ships with 1.22
I received mine yesterday. I  was expecting 1.21
It will be going back Friday/Monday as I am away till then.
Stuck at airport. Flight delayed 2h

I take it that you tried the 1.21 hack on your device, and it didn't work?

[Nemonic]

all new E4 stock ships with 1.22
I received mine yesterday. I  was expecting 1.21
It will be going back Friday/Monday as I am away till then.
Stuck at airport. Flight delayed 2h

I take it that you tried the 1.21 hack on your device, and it didn't work?

It does work! v1.21 AND v1.22 are both able to be unlocked to the full potential 320x240 IR. I have an E4 1.1L v1.22fw sat infront of me with full 320x240 IR res. I have no idea what the fpga.bin changes are, but they do not seem to stop the unlocking of the IR res.

Also the beta3 menu options for zoom, pip etc all seem to work.

[Hepe]

Today got My E4

Model E4 1.1L
Serial Number 639178xx
Part Number 63901-0101
Software 1.22.0

5 mins work and everything seems to be crystalclear. And the new menus..   

Thank you everyone on this forum for your great work.

Sofia, FTP to your camera and find folder flashfs\system\appcore.d\config.d   - there is your conf.cfc. and "decrypt" it with ftool, remember those SUID codes for crypting your conf after modifications... You can use that example config from tools1.zip just add your device-id (from decrypted conf file) and create new CRC03 for that file and add it bottom of your file... then crypt it back with ftool using SUID got before, then you can ftp that file back to device.

[olsenn]

So I am still happily rocking a hacked E4 with firmware 1.18 or something like that -- is there a changelog for what is new in 1.19, 1.21, and 1.22? (Apart from anti-hacking measures... I mean any new functionality or bug fixes)?

[mago]

hi all, congrats for the wonderful hack work !

one question: with a "patched" E4 (=E8) what can i do about remote screen viewing?
i mean, while connected to a pc with USB, can i see TIC screen real time with flir tool? Is it possibile with full resolution or lower? How much lag?

Thanks for any1 replying 

[Fraser]

Discount from UK Supplier of E4

I have just spoken to David Atkins at PASS in the UK.

David advised that they currently have 35 E4's in stock and that they are still willing to offer members of the EEVBlog Forum a discount. I have found PASS to be a reliable company with which to do business but it is important that you talk to David in order to secure the discount and obtain the best possible service.

Davids direct contact details are to be found here:

 https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg328110/#msg328110

David Atkins is not just some generic sales person, he is a trained thermographer and knows his topic. The Company Director of PASS is Barry Atkins and the Company Secretary is Ms Catherine Atkins This appears to be a family run company, rather than some large faceless combine. These family run companies are the ones that I like to do business with.

I am not connected with PASS in any way and just want to keep EEVBlog mebership aware of available discounts in the UK so that they may benefit.

To claim the discount, just contact David and let him know that you are a member of this forum.

[ixfd64]

all new E4 stock ships with 1.22
I received mine yesterday. I  was expecting 1.21
It will be going back Friday/Monday as I am away till then.
Stuck at airport. Flight delayed 2h

I take it that you tried the 1.21 hack on your device, and it didn't work?

It does work! v1.21 AND v1.22 are both able to be unlocked to the full potential 320x240 IR. I have an E4 1.1L v1.22fw sat infront of me with full 320x240 IR res. I have no idea what the fpga.bin changes are, but they do not seem to stop the unlocking of the IR res.

Also the beta3 menu options for zoom, pip etc all seem to work.

That's nice to know.

Mike, it might be a good idea to mention on the first post that the hack works on 1.22.0 devices as well.