Poll

Has the hackabiliy of the E4 made you buy one :  

Yes, I was already looking at the competition at a similar price, but the hack swung it to E4
229 (26.1%)
Yes, I'd not considered buying a TIC before, but 320x240 resolution at this price justifies it (as either tool or toy!)
414 (47.2%)
Yes, I was going to buy an E5/6/8 class of unit but will now get the E4
41 (4.7%)
No, but am looking out for a cheap i3 to hack
39 (4.4%)
Not yet, but probably will if now that a closed-box hack becomes is possible
155 (17.7%)

Total Members Voted: 753

Author Topic: Flir E4 Thermal imaging camera teardown  (Read 2423182 times)

0 Members and 3 Guests are viewing this topic.

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 11289
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #50 on: October 21, 2013, 05:17:13 am »
I just remembered something about WinCE not being able to access a volume when it was mounted via USB.
Once USB unplugged, you get another folder in the root directory - FlashIFS, so you can copy stuff on & off the device via this..!

« Last Edit: October 21, 2013, 05:20:08 am by mikeselectricstuff »
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline mrflibble

  • Super Contributor
  • ***
  • Posts: 1878
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #51 on: October 21, 2013, 05:33:21 am »
Love the new boot splash!  ;D

And that other serial port also looks pretty damn interesting.
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 11289
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #52 on: October 21, 2013, 05:36:10 am »
This looks important....
Code: [Select]
\flashfs\system\appcore.d\config.d>type conf.cfg
#
# Generated at 2013-06-12 14:30:34
#
.caps entry
.caps.config entry
.caps.config.name text "app E4"
.caps.config.revision text "1.0"
.caps.config.image entry
.caps.config.image.framegrab entry
.caps.config.image.framegrab.fusion entry
.caps.config.image.framegrab.fusion.enabled bool true
.caps.config.image.framegrab.fusion.pip entry
.caps.config.image.framegrab.fusion.pip.enabled bool true
.caps.config.image.framegrab.fusion.hcf entry
.caps.config.image.framegrab.fusion.hcf.enabled bool true
.caps.config.image.services entry
.caps.config.image.services.store entry
.caps.config.image.services.store.enabled bool true
.caps.config.image.services.store.radiometric entry
.caps.config.image.services.store.radiometric.enabled bool true
.caps.config.image.services.store.incompatible entry
.caps.config.image.services.store.incompatible.enabled bool false
.caps.config.image.services.store.incompatible.level int32 0
.caps.config.image.settings entry
.caps.config.image.settings.enabled bool true
.caps.config.image.settings.IRwidth int32 80
.caps.config.image.settings.IRheight int32 60
.caps.config.image.sysimg entry
.caps.config.image.sysimg.alarms entry
.caps.config.image.sysimg.alarms.enabled bool false
.caps.config.image.sysimg.alarms.measfunc entry
.caps.config.image.sysimg.alarms.measfunc.enabled bool false
.caps.config.image.sysimg.alarms.measfunc.maxCount int32 3
.caps.config.image.sysimg.alarms.humidity entry
.caps.config.image.sysimg.alarms.humidity.enabled bool false
.caps.config.image.sysimg.alarms.humidity.maxCount int32 1
.caps.config.image.sysimg.alarms.insulation entry
.caps.config.image.sysimg.alarms.insulation.enabled bool false
.caps.config.image.sysimg.alarms.insulation.maxCount int32 1
.caps.config.image.sysimg.irMarkers entry
.caps.config.image.sysimg.irMarkers.enabled bool false
.caps.config.image.sysimg.irMarkers.spot entry
.caps.config.image.sysimg.irMarkers.spot.enabled bool false
.caps.config.image.sysimg.irMarkers.spot.maxCount int32 0
.caps.config.image.sysimg.irMarkers.arrow entry
.caps.config.image.sysimg.irMarkers.arrow.enabled bool false
.caps.config.image.sysimg.irMarkers.arrow.maxCount int32 0
.caps.config.image.sysimg.irMarkers.box entry
.caps.config.image.sysimg.irMarkers.box.enabled bool false
.caps.config.image.sysimg.irMarkers.box.maxCount int32 0
.caps.config.image.sysimg.measureFuncs entry
.caps.config.image.sysimg.measureFuncs.enabled bool true
.caps.config.image.sysimg.measureFuncs.diff entry
.caps.config.image.sysimg.measureFuncs.diff.enabled bool false
.caps.config.image.sysimg.measureFuncs.diff.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.diff.calcMask int32 65526
.caps.config.image.sysimg.measureFuncs.isotherm entry
.caps.config.image.sysimg.measureFuncs.isotherm.enabled bool false
.caps.config.image.sysimg.measureFuncs.isotherm.calcMask int32 20
.caps.config.image.sysimg.measureFuncs.isotherm.dual bool false
.caps.config.image.sysimg.measureFuncs.isotherm.fixScale bool false
.caps.config.image.sysimg.measureFuncs.isotherm.interval bool false
.caps.config.image.sysimg.measureFuncs.isotherm.invInterval bool false
.caps.config.image.sysimg.measureFuncs.isotherm.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.mbox entry
.caps.config.image.sysimg.measureFuncs.mbox.enabled bool false
.caps.config.image.sysimg.measureFuncs.mbox.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mbox.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.mcircle entry
.caps.config.image.sysimg.measureFuncs.mcircle.enabled bool false
.caps.config.image.sysimg.measureFuncs.mcircle.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mcircle.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.mline entry
.caps.config.image.sysimg.measureFuncs.mline.enabled bool false
.caps.config.image.sysimg.measureFuncs.mline.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mline.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.reftemp entry
.caps.config.image.sysimg.measureFuncs.reftemp.enabled bool false
.caps.config.image.sysimg.measureFuncs.reftemp.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.reftemp.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.script entry
.caps.config.image.sysimg.measureFuncs.script.enabled false
.caps.config.image.sysimg.measureFuncs.script.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.spot entry
.caps.config.image.sysimg.measureFuncs.spot.enabled bool true
.caps.config.image.sysimg.measureFuncs.spot.calcMask int32 514
.caps.config.image.sysimg.measureFuncs.spot.maxCount int32 1
.caps.config.image.sysimg.visualMarkers entry
.caps.config.image.sysimg.visualMarkers.enabled bool false
.caps.config.image.sysimg.visualMarkers.spot entry
.caps.config.image.sysimg.visualMarkers.spot.enabled bool false
.caps.config.image.sysimg.visualMarkers.spot.maxCount int32 0
.caps.config.image.sysimg.visualMarkers.arrow entry
.caps.config.image.sysimg.visualMarkers.arrow.enabled bool false
.caps.config.image.sysimg.visualMarkers.arrow.maxCount int32 0
.caps.config.image.sysimg.visualMarkers.box entry
.caps.config.image.sysimg.visualMarkers.box.enabled bool false
.caps.config.image.sysimg.visualMarkers.box.maxCount int32 0
.caps.config.image.contadj entry
.caps.config.image.contadj.minSpanFactor entry
.caps.config.image.contadj.minSpanFactor.enabled bool true
.caps.config.image.contadj.minSpanFactor.factorAuto double 2.0
.caps.config.image.contadj.minSpanFactor.factorManual double 2.0
.caps.config.image.targetNoise entry
.caps.config.image.targetNoise.enabled bool true
.caps.config.image.targetNoise.targetNoiseMk int32 135
.caps.config.image.zoom entry
.caps.config.image.zoom.enabled bool false
.caps.config.image.zoom.maxFactor double 1
.caps.config.system entry
.caps.config.system.focus entry
.caps.config.system.focus.laser entry
.caps.config.system.focus.laser.updateFocus entry
.caps.config.system.focus.laser.updateFocus.enabled bool false
.caps.config.ui entry
.caps.config.ui.fusion entry
.caps.config.ui.fusion.PIP entry
.caps.config.ui.fusion.PIP.enabled bool false
.caps.hw entry
.caps.hw.sdcard entry
.caps.hw.sdcard.enabled bool false
# ID 63903771
# CRC01 f032b591
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 11289
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #53 on: October 21, 2013, 05:42:15 am »
..and this similar but interestingly different file in a "service" directory, could be handy if it's looking at the CRCs.
Code: [Select]
# Generated at CONFIG_DATE CONFIG_TIME
#
.caps entry
.caps.config entry
.caps.config.name text "app prodconvconf_std"
.caps.config.revision text "999.9KaKaOnly"
.caps.config.image entry
.caps.config.image.framegrab entry
.caps.config.image.framegrab.fusion entry
.caps.config.image.framegrab.fusion.enabled bool true
.caps.config.image.sensor entry
.caps.config.image.sensor.enabled bool true
.caps.config.image.services entry
.caps.config.image.services.store entry
.caps.config.image.services.store.enabled bool true
.caps.config.image.services.store.radiometric entry
.caps.config.image.services.store.radiometric.enabled bool true
.caps.config.image.services.store.incompatible entry
.caps.config.image.services.store.incompatible.enabled bool false
.caps.config.image.services.store.incompatible.level int32 0
.caps.config.image.settings entry
.caps.config.image.settings.enabled bool true
.caps.config.image.settings.IRheight int32 240
.caps.config.image.settings.IRwidth int32 320
.caps.config.image.sysimg entry
.caps.config.image.sysimg.alarms entry
.caps.config.image.sysimg.alarms.enabled bool true
.caps.config.image.sysimg.alarms.measfunc entry
.caps.config.image.sysimg.alarms.measfunc.enabled bool true
.caps.config.image.sysimg.alarms.measfunc.maxCount int32 3
.caps.config.image.sysimg.alarms.humidity entry
.caps.config.image.sysimg.alarms.humidity.enabled bool true
.caps.config.image.sysimg.alarms.humidity.maxCount int32 1
.caps.config.image.sysimg.alarms.insulation entry
.caps.config.image.sysimg.alarms.insulation.enabled bool true
.caps.config.image.sysimg.alarms.insulation.maxCount int32 1
.caps.config.image.sysimg.irMarkers entry
.caps.config.image.sysimg.irMarkers.enabled bool true
.caps.config.image.sysimg.irMarkers.spot entry
.caps.config.image.sysimg.irMarkers.spot.enabled bool false
.caps.config.image.sysimg.irMarkers.spot.maxCount int32 0
.caps.config.image.sysimg.irMarkers.arrow entry
.caps.config.image.sysimg.irMarkers.arrow.enabled bool true
.caps.config.image.sysimg.irMarkers.arrow.maxCount int32 4
.caps.config.image.sysimg.irMarkers.box entry
.caps.config.image.sysimg.irMarkers.box.enabled bool false
.caps.config.image.sysimg.irMarkers.box.maxCount int32 0
.caps.config.image.sysimg.measureFuncs entry
.caps.config.image.sysimg.measureFuncs.enabled bool true
.caps.config.image.sysimg.measureFuncs.diff entry
.caps.config.image.sysimg.measureFuncs.diff.enabled bool true
.caps.config.image.sysimg.measureFuncs.diff.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.diff.calcMask int32 65526
.caps.config.image.sysimg.measureFuncs.isotherm entry
.caps.config.image.sysimg.measureFuncs.isotherm.enabled bool true
.caps.config.image.sysimg.measureFuncs.isotherm.calcMask int32 20
.caps.config.image.sysimg.measureFuncs.isotherm.dual bool false
.caps.config.image.sysimg.measureFuncs.isotherm.fixScale bool false
.caps.config.image.sysimg.measureFuncs.isotherm.interval bool true
.caps.config.image.sysimg.measureFuncs.isotherm.invInterval bool false
.caps.config.image.sysimg.measureFuncs.isotherm.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.mbox entry
.caps.config.image.sysimg.measureFuncs.mbox.enabled bool true
.caps.config.image.sysimg.measureFuncs.mbox.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mbox.maxCount int32 5
.caps.config.image.sysimg.measureFuncs.mcircle entry
.caps.config.image.sysimg.measureFuncs.mcircle.enabled bool false
.caps.config.image.sysimg.measureFuncs.mcircle.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mcircle.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.mline entry
.caps.config.image.sysimg.measureFuncs.mline.enabled bool false
.caps.config.image.sysimg.measureFuncs.mline.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mline.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.reftemp entry
.caps.config.image.sysimg.measureFuncs.reftemp.enabled bool true
.caps.config.image.sysimg.measureFuncs.reftemp.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.reftemp.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.script entry
.caps.config.image.sysimg.measureFuncs.script.enabled false
.caps.config.image.sysimg.measureFuncs.script.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.spot entry
.caps.config.image.sysimg.measureFuncs.spot.enabled bool true
.caps.config.image.sysimg.measureFuncs.spot.calcMask int32 514
.caps.config.image.sysimg.measureFuncs.spot.maxCount int32 5
.caps.config.image.sysimg.visualMarkers entry
.caps.config.image.sysimg.visualMarkers.enabled bool true
.caps.config.image.sysimg.visualMarkers.spot entry
.caps.config.image.sysimg.visualMarkers.spot.enabled bool false
.caps.config.image.sysimg.visualMarkers.spot.maxCount int32 0
.caps.config.image.sysimg.visualMarkers.arrow entry
.caps.config.image.sysimg.visualMarkers.arrow.enabled bool true
.caps.config.image.sysimg.visualMarkers.arrow.maxCount int32 4
.caps.config.image.sysimg.visualMarkers.box entry
.caps.config.image.sysimg.visualMarkers.box.enabled bool false
.caps.config.image.sysimg.visualMarkers.box.maxCount int32 0
.caps.config.image.targetNoise entry
.caps.config.image.targetNoise.enabled bool false
.caps.config.image.targetNoise.targetNoiseMk int32 0
.caps.config.image.zoom entry
.caps.config.image.zoom.enabled bool true
.caps.config.image.zoom.maxFactor double 8
.caps.config.system entry
.caps.config.system.focus entry
.caps.config.system.focus.laser entry
.caps.config.system.focus.laser.updateFocus entry
.caps.config.system.focus.laser.updateFocus.enabled bool true
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline bean_dip

  • Contributor
  • Posts: 12
Re: Flir E4 Thermal imaging camera teardown
« Reply #54 on: October 21, 2013, 05:42:52 am »
This looks important....

Ooo...that does look important.  I had been looking through the update I downloaded from the FLIR website, but that folder is not included.  I did find this while trying to disassemble the .exe's in the firware...  Hopefully when my E4 arrives I'll be able to help more (ordered yesterday after convincing myself that it could one day be an E8).

Code: [Select]
usage: gethwtype [-h] [-v]
   -h   Help, show this text
   -v   verbose, show additional info

Identifies FLIR hardware that this utility runs on


Shows hardware as: <type><subtype>


Known hardwares:

Qx - unknown HW.
H1 - Fire camera
Y1 - T-MkII(Ylva) camera
Z3 - ASCO camera
Z2 - IVCO or ZOCO_BLUE camera
Z1 - ZOCO camera
S1 - SART camera
F1 - Liston camera
T1 - PT camera
R1 - A2 camera
X1 - Ixx
G1 - GF
P2 - P-Cam, BACP2
P1C- P-Cam, BACP rev >=08, UIP rev>=05
P1B- P-Cam, BACP rev >=08, UIP rev 03/04
P1A- P-Cam, BACP rev 07
A5B- A-Cam S, AHCO3 AND SB0601 30 Hz detector
A5A- A-Cam S, AHCO3 AND SB0601 9 Hz detector
A4B- A-Cam R, AHCO AND SB0601 30 Hz detector
A4A- A-Cam R, AHCO AND SB0601 9 Hz detector
A3B- A-Cam S, AHCO AND SB0601 30 Hz detector
A3A- A-Cam S, AHCO AND SB0601 9 Hz detector
A2B- A-Cam R, AHCO AND SB040 30 Hz detector
A2A- A-Cam R, AHCO AND SB040 9 Hz detector
A1B- A-Cam S, AHCO AND SB0401 30 Hz detector
A1A- A-Cam S, AHCO AND SB0401 9 Hz detector
Ex - T-Cam, unknown subtype (remote)
E4 - T-Cam, BACT2 AND ULIS detector
E3B- T-Cam, BACT2 AND SB0601 30 Hz detector
E3A- T-Cam, BACT2 AND SB0601 9 Hz detector
E2B- T-Cam, BACT AND SB0601 30 Hz detector
E2A- T-Cam, BACT AND SB0601 9 Hz detector
E1B- T-Cam, BACE rev 04-07 AND SB0401 30Hz
E1A- T-Cam, BACE rev 04-07 AND SB0401 9 Hz
 

Online Fraser

  • Super Contributor
  • ***
  • Posts: 7460
  • Country: gb
Re: Flir E4 Thermal imaging camera teardown
« Reply #55 on: October 21, 2013, 05:54:18 am »
I don't need an E4 (or an E8) but I am rivetted to this thread. I love it when someone with a decent brain penetrates the OS of a sytem to increase its capabilities. Its like some sort of 'Black Op'  :-+

Great work Mike and you may get some additional help with Beaan-dip also working on the challenge.  :)

My FLIR PM5xx and 6xx series TIC's also have two serial ports. One for remote control, and one dedicated to factory use. I shall have to give the factory port a poke to see what is there  :)

I am not as skilled in this area as Mike but I would be interested to see whether I can enable the (already fitted) high temperaturefilter on my cameras. It just needs a software change to set it to 'present'. The menu then permits its use. I had better repair my remaining project unit first though.
« Last Edit: October 21, 2013, 06:03:50 am by Aurora »
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 11289
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #56 on: October 21, 2013, 06:21:13 am »
Quote
Ooo...that does look important.  I had been looking through the update I downloaded from the FLIR website, but that folder is not included.

It appears that the contents of flashfs are created at factory test/cal time.,and comprise a ton of config & cal data
flashBFS seems to be system, which looks like what is in the update file.
The file creation dates are also interesting.

Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 11289
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #57 on: October 21, 2013, 06:35:21 am »
Oops!
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 11289
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #58 on: October 21, 2013, 06:58:14 am »
Editing that conf.cfg file doesn't seem to do anything...  :(
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 11289
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #59 on: October 21, 2013, 07:01:44 am »
Quote
usage: gethwtype [-h] [-v]

Z3 - ASCO camera

returns Z3
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline bean_dip

  • Contributor
  • Posts: 12
Re: Flir E4 Thermal imaging camera teardown
« Reply #60 on: October 21, 2013, 07:08:06 am »
Editing that conf.cfg file doesn't seem to do anything...  :(

I wonder if this has anything to do with it... from /system/combtabs.d/combtab.appkit:

Code: [Select]
# combtab file for Astra
# This file should be present as different filenames in
# appkit, prodkit and OS project directory
TYPE combtab
#unique file identifier
DATE 2013-08-14
# Newest date for any combtab file identifies file to use.
# We cannot rely on file date because that might change when transfering files
KITS osimgkit, appkit, prodkit
# KITS line identifies resource branch for columns used in file. comma separated.
SHORT os, appkit, prodkit
# SHORT line identifies kits in the concatenated fullver resource. comma separated.
COMBINATIONS
# this line identifies that table starts.
# table lines comma separated as KITS above
# KITS osimgkit, appkit, prodkit
0.1.1, 1.0.1, 0.1.0, 0.1.0.1
0.2.2, 1.0.3, 0.2.0, 0.1.0.2
0.3.3, 1.0.5, 0.3.0, 0.1.0.3
0.4.3, 1.0.7, 0.3.0, 0.1.0.3
0.5.3, 1.0.7, 0.4.0, 0.1.0.3
0.5.4, 1.0.7, 0.4.0, 0.1.0.4
0.6.5, 1.0.9, 0.5.0, 0.1.0.5
0.7.6, 1.0.11, 0.6.0, 0.1.0.6
0.8.7,  1.0.11, 0.6.1,  0.6.1.7
0.9.7,  1.0.11, 0.6.2,  0.6.1.7
0.10.8,  1.0.11, 0.6.3,  0.6.1.8
0.11.8,  1.0.13, 0.6.3,  0.6.1.8
0.12.8,  1.0.13, 0.6.4,  0.6.1.8
0.13.8,  1.0.13, 0.6.5,  0.6.1.8
0.13.9,  1.0.13, 0.6.5,  0.6.1.9
0.14.9,  1.0.15, 0.6.5,  0.6.1.9
0.15.9,  1.0.15, 0.6.6,  0.6.1.9
0.15.10,  1.0.15, 0.6.6, 0.6.1.10
0.16.10,  1.0.17, 0.6.6, 0.6.1.10
0.17.10,  1.0.17, 0.6.7, 0.6.1.10
0.17.11,  1.0.17, 0.6.7, 0.6.1.11
0.18.11,  1.0.19, 0.6.7, 0.6.1.11
0.19.11,  1.0.19, 0.6.8, 0.6.1.11
0.19.12,  1.0.19, 0.6.8, 0.6.1.12
0.20.12,  1.0.21, 0.6.8, 0.6.1.12
0.21.12,  1.0.21, 0.6.9, 0.6.1.12
0.21.13,  1.0.21, 0.6.9, 0.6.1.13
0.22.13,  1.0.21, 0.6.10, 0.6.1.13
0.23.13,  1.0.23, 0.6.10, 0.6.1.13
1.0.1, 16.0.0, 1.0.0, 1.0.0.1
1.1.1, 16.0.2, 1.0.0, 1.0.0.1
 

Offline ixfd64

  • Frequent Contributor
  • **
  • Posts: 308
  • Country: us
    • Facebook
Re: Flir E4 Thermal imaging camera teardown
« Reply #61 on: October 21, 2013, 07:12:17 am »
Maybe all of this could convince the thermal camera makers to reduce their prices. I can dream, right? ;D

Online Fraser

  • Super Contributor
  • ***
  • Posts: 7460
  • Country: gb
Re: Flir E4 Thermal imaging camera teardown
« Reply #62 on: October 21, 2013, 07:19:21 am »
Nope, it will teach them to install security in their design to prevent such firmware analysis  ;)
« Last Edit: October 21, 2013, 07:23:04 am by Aurora »
 

Offline ixfd64

  • Frequent Contributor
  • **
  • Posts: 308
  • Country: us
    • Facebook
Re: Flir E4 Thermal imaging camera teardown
« Reply #63 on: October 21, 2013, 07:25:44 am »
That kind of reminds me of when Texas Instruments went after graphing calculator hobbyists for breaking their signing keys. It didn't end too well for the company.
« Last Edit: October 21, 2013, 07:28:50 am by ixfd64 »
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 11289
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #64 on: October 21, 2013, 07:26:22 am »
Digging around UI files in the FW update suggests a hidden menu.
 
Quote
  <ui_model type="RetailModeSettingsModel" name="retailModeSettingsModel">
    <ui_model_item type="SettingItem" ID="OFF" label="ID_RETAIL_OFF" radio="true"/>
    <ui_model_item type="SettingItem" ID="ELECTRICAL" label="ID_RETAIL_ELECTRICAL_APPLICATIONS" radio="true"/>
    <ui_model_item type="SettingItem" ID="BUILDING" label="ID_RETAIL_BUILDING_APPLICATIONS" radio="true"/>
  </ui_model>

<ui_model type="HiddenServiceSettingsModel" name="hiddenServiceSettingsModel">
    <ui_model_item type="SettingItem" ID="USB_MODE" label="ID_SETUP_USB_MODE"

nextModel="usbModeSettingsModel" nextQML="SettingsPage.qml" settingType="entry" />
    <ui_model_item type="SettingItem" ID="EXPORT_INFO" label="ID_SETUP_EXPORT_INFO" />

    <ui_model_item type="SettingItem" ID="VERSION_INFO" label="ID_SETUP_VERSION_INFO" nextModel="versionSettingsModel" nextQML="SettingsPage.qml" settingType="entry" />
  </ui_model>
Quote
  <ui_model type="USBModeSettingsModel" name="usbModeSettingsModel">
    <ui_model_item type="SettingItem" ID="MSD" label="MSD" radio="true"/>
    <ui_model_item type="SettingItem" ID="UVC" label="UVC" radio="true"/>
    <ui_model_item type="SettingItem" ID="RNDIS" label="RNDIS" radio="true" />
    <ui_model_item type="SettingItem" ID="RNDIS_UVC" label="RNDIS and UVC" radio="true"/>
    <ui_model_item type="SettingItem" ID="RNDIS_MSD" label="RNDIS and MSD" radio="true"/>
    <ui_model_item type="SettingItem" ID="UVC_MSD" label="UVC and MSD" radio="true" />
    <ui_model_item type="SettingItem" ID="RNDIS_UVC_MSD" label="RNDIS, UVC and MSD" radio="true"/>
  </ui_model>
I believe RNDIS is the critical thing - from what I recall from the i7 email it allows virtual networking to either TELNET or similar into the console, or FTP access.
Incidentally re. comments about noise earlier  :

"Normal" mode :
Quote
.caps.config.image.targetNoise entry
.caps.config.image.targetNoise.enabled bool true
.caps.config.image.targetNoise.targetNoiseMk int32 135
"Service" mode :
Quote
.caps.config.image.targetNoise entry
.caps.config.image.targetNoise.enabled bool false
.caps.config.image.targetNoise.targetNoiseMk int32 0


 

« Last Edit: October 21, 2013, 07:32:44 am by mikeselectricstuff »
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 11289
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #65 on: October 21, 2013, 07:28:13 am »
Editing that conf.cfg file doesn't seem to do anything...  :(

I wonder if this has anything to do with it... from /system/combtabs.d/combtab.appkit:

Code: [Select]
# combtab file for Astra
# This file should be present as different filenames in
# appkit, prodkit and OS project directory
TYPE combtab
#unique file identifier
DATE 2013-08-14
# Newest date for any combtab file identifies file to use.
# We cannot rely on file date because that might change when transfering files
KITS osimgkit, appkit, prodkit
# KITS line identifies resource branch for columns used in file. comma separated.
SHORT os, appkit, prodkit
# SHORT line identifies kits in the concatenated fullver resource. comma separated.
COMBINATIONS
# this line identifies that table starts.
# table lines comma separated as KITS above
# KITS osimgkit, appkit, prodkit
0.1.1, 1.0.1, 0.1.0, 0.1.0.1
0.2.2, 1.0.3, 0.2.0, 0.1.0.2
0.3.3, 1.0.5, 0.3.0, 0.1.0.3
0.4.3, 1.0.7, 0.3.0, 0.1.0.3
0.5.3, 1.0.7, 0.4.0, 0.1.0.3
0.5.4, 1.0.7, 0.4.0, 0.1.0.4
0.6.5, 1.0.9, 0.5.0, 0.1.0.5
0.7.6, 1.0.11, 0.6.0, 0.1.0.6
0.8.7,  1.0.11, 0.6.1,  0.6.1.7
0.9.7,  1.0.11, 0.6.2,  0.6.1.7
0.10.8,  1.0.11, 0.6.3,  0.6.1.8
0.11.8,  1.0.13, 0.6.3,  0.6.1.8
0.12.8,  1.0.13, 0.6.4,  0.6.1.8
0.13.8,  1.0.13, 0.6.5,  0.6.1.8
0.13.9,  1.0.13, 0.6.5,  0.6.1.9
0.14.9,  1.0.15, 0.6.5,  0.6.1.9
0.15.9,  1.0.15, 0.6.6,  0.6.1.9
0.15.10,  1.0.15, 0.6.6, 0.6.1.10
0.16.10,  1.0.17, 0.6.6, 0.6.1.10
0.17.10,  1.0.17, 0.6.7, 0.6.1.10
0.17.11,  1.0.17, 0.6.7, 0.6.1.11
0.18.11,  1.0.19, 0.6.7, 0.6.1.11
0.19.11,  1.0.19, 0.6.8, 0.6.1.11
0.19.12,  1.0.19, 0.6.8, 0.6.1.12
0.20.12,  1.0.21, 0.6.8, 0.6.1.12
0.21.12,  1.0.21, 0.6.9, 0.6.1.12
0.21.13,  1.0.21, 0.6.9, 0.6.1.13
0.22.13,  1.0.21, 0.6.10, 0.6.1.13
0.23.13,  1.0.23, 0.6.10, 0.6.1.13
1.0.1, 16.0.0, 1.0.0, 1.0.0.1
1.1.1, 16.0.2, 1.0.0, 1.0.0.1
I saw those - I think those numbers may be a reference to numbers in the eeprom.
BTW there is an I2C command in the console that appear to allow eeprom fiddling

Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline Stonent

  • Super Contributor
  • ***
  • Posts: 3824
  • Country: us
Re: Flir E4 Thermal imaging camera teardown
« Reply #66 on: October 21, 2013, 07:35:51 am »
I just remembered something about WinCE not being able to access a volume when it was mounted via USB.
Once USB unplugged, you get another folder in the root directory - FlashIFS, so you can copy stuff on & off the device via this..!


 :-+
The larger the government, the smaller the citizen.
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 11289
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #67 on: October 21, 2013, 07:42:24 am »
I think this means the hidden menu comes after any item in the camera settings menu. Either a magic key in the menu, or a key combination at startup (probably hard start, not out of standby)
Quote

<ui_model type="CameraInfoSettingsModel" name="cameraInfoSettingsModel">
    <ui_model_item type="SettingItem" ID="MODEL" label="ID_SETUP_MODEL" value="*" nextModel="hiddenServiceSettingsModel"/>
    <ui_model_item type="SettingItem" ID="SERIAL" label="ID_SETUP_SERIAL" value="*" nextModel="hiddenServiceSettingsModel"/>
    <ui_model_item type="SettingItem" ID="PART" label="ID_SETUP_PART" value="*" nextModel="hiddenServiceSettingsModel"/>
    <ui_model_item type="SettingItem" ID="SOFTWARE" label="ID_SETUP_SOFTWARE" value="*" nextModel="hiddenServiceSettingsModel"/>
  </ui_model>

If someone has an E4 and some time on their hands, it would be worth trying some random key combinations at powerup, then going into the camera info screen & seeing if you can get deeper....
I can't immediately find any obvious keys in this menu with a normal startup
« Last Edit: October 21, 2013, 07:56:23 am by mikeselectricstuff »
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Online Fraser

  • Super Contributor
  • ***
  • Posts: 7460
  • Country: gb
Re: Flir E4 Thermal imaging camera teardown
« Reply #68 on: October 21, 2013, 08:00:44 am »
Mike,

My email provider keeps copies of my email on line for remote acess. Any chance your 'lost' i7 email still resides on your on-line  email arechive ? It might make your life a little easier.
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 11289
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #69 on: October 21, 2013, 08:21:23 am »
Oh Mike.....you LOST the hack email   :palm:

Or did you hear the distinctive thump-thump-thump of the black helicopters rotors overhead ?  :scared:

If you ask GCHQ or the NSA nicely, they may provide you with their copy of the email  :-DD
Yep - hard disk on that laptop was failing around the time I got it - have tried to recover but no joy so far - may still be in there somewhere..

However.....
If you download the Ex firmware from Flir, and rename the .fif file to .cab  Many very interesting things appear.... Will take some time to examine....

What, you don't have your emails backed up or hosted online?  :palm:
Mostly yes, but  it was on a laptop I use in the house for casual email & web access & must have accidentally deleted the message from server before downloading on main PC. I didn't pay too much attention at the time as it seemed rather specific to the i7 - was only a few days later I realised it could be more significant.
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline mrflibble

  • Super Contributor
  • ***
  • Posts: 1878
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #70 on: October 21, 2013, 08:40:07 am »
Well, just in case you lose your posts in here and Dave's backups don't work ... not to worry, I'm mirroring this thread. And that does get backed up. :P

OT: was the big fat error when you edited the conf file? You could try editing it and then restoring the datestamp to the original date. Just in case they do something with the datestamp. Did you grab a serial dump during changed conf? I noticed a kind of expect count check in there for message counts. At start it said something along the lines of "expecting N messages" and then near the end it confirmed having received precisely N of those messages.

Also, does anyone have any direct links to E4 and E8 firmware downloads?
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 11289
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #71 on: October 21, 2013, 08:44:17 am »
OT: was the big fat error when you edited the conf file?
No - I was messing around running random executables.
Quote
Did you grab a serial dump during changed conf?
Doesn't look obviously different - didn't look in fine detail - no error messages or anything, either with an edited file (=possible  bad crc) or swapping the service one in..
Quote
Also, does anyone have any direct links to E4 and E8 firmware downloads?
Ex is on the Flir site (need to register) - has a silly javascript link so can't link direct.
 
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 11289
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #72 on: October 21, 2013, 09:44:53 am »
Some possibly interesting snippets in this file
http://www.imc-store.com.au/v/vspfiles/assets/images/flir%20a310%20technical%20notes.pdf
For a different model, but recent, and the web  interface matches some things found in the web folder of the Ex FW update file

Also possibly interesting stuff in the file linked in the above doc  - documents some of the WinCE  executables
« Last Edit: October 21, 2013, 09:46:25 am by mikeselectricstuff »
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 11289
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #73 on: October 21, 2013, 10:33:13 am »
Here are the pinouts I've determined so far on the hidden bottom connector of the i7, for those interested. Is such a connector present on the E-series?
No -the connector is an internal FFC con.
You may find a second UART - on bootup it only throws out a few chars.
Also worth a good look through the FW update file, if available.

The PDF linked from the PDF I found above is very interesting.
All the settings are in "resources" a la Windows registry. These appear related to the various conf files, but not clear in which direction - it may be the files are derived from the resource settings or vice versa.
Look at the resource related commands in that second PDF. Beware rls -r recursive option - it spits out a LOT of data!
Unfortunately rset doesn't appear to work on image size, but have been able to set user settings using it.


« Last Edit: October 21, 2013, 10:36:11 am by mikeselectricstuff »
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline mrflibble

  • Super Contributor
  • ***
  • Posts: 1878
  • Country: nl
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf