EEVblog Electronics Community Forum

Products => Thermal Imaging => Topic started by: mikeselectricstuff on October 13, 2013, 08:18:10 pm

Title: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 13, 2013, 08:18:10 pm
TL;DR :
26 Dec 2016  Updated method for firmware V2.11  (http://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg921880/#msg921880)( no need to downgrade to 2.3)
10 Jan 2016 There is a new firmware, V2.8, which needs to be downgraded to 2.3 for the hack to work. Instructions in This post (http://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg839561/#msg839561)
30 Mar 2015 Link to step-by-step guide for 2.3 firmware (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg640825/#msg640825)
12th Jan 2015  Link to hack instructions for 2.3 firmware (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg585647/#msg585647)
24th Oct 2014
It appears that V2.3 firmware has now been successfully hacked, but only for increased resolution - see This post (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg534297/#msg534297) and the few that follow for more details.
13th July 2014
New units are shipping with firmware V2.3, which appears to have an encrypted config file. Details of how this version it affects hackability are not yet established - check the end of the thread for updates.
(An earlier version, 2.1 appeared briefly but was reported to have connectivity issues.) 
One user  has reported that an old unit sent back for repair was upgraded to 2.3 during repair (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg478554/#msg478554), but was still hackable afterwards. See follow-ups to this post for more info.

1.2x has countermeasures against the original hack, however  1.21  and 1.22 have now been successfully hacked.
This post will be updated with any important developments, however always
check the end of the thread for latest info


newbie Q&A thread (http://www.eevblog.com/forum/testgear/flir-e4-teardown-qa-and-newbie-questions/) - please post questions about implementing existing hacks there and not in this thread

Marphy's TIConfig utility for one-click upgrade of all current firmware versions (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg421535/#msg421535)

1.21/1.22 firmware hack info  (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg403480/#msg403480)

DaveWB's video tutorials for old and new firmware versions (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg409787/#msg409787)

Link to old firmware hack info for all 1.19.x versions b (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg321956/#msg321956)

Link to Taucher's menu hacks (Beta - for advanced users) (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg326024/#msg326024) These enable extra features not even available on the E8 like manual temperature mode, additional pallettes and measure modes, and digital zoom.
check the end of the thread[/b] for any very recent updates.

Info on hacking E30 to E60 (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg561266/#msg561266)

Link to Nersut's detailed guide to hacking the i series (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg348174/#msg348174)
Link to older i3 hack info (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg326229/#msg326229)

Tomas123's links on post- processing and measurements using E4 images (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg342072/#msg342072)

Jolly's raspberry Pi E4 video recorder (http://www.eevblog.com/forum/testgear/capturing-video-from-flir-e4-to-portable-device/msg365918/#msg365918)

Links to useful files and documents :
Aurora's Useful  information thread, including log of versions and serial numbers (http://www.eevblog.com/forum/reviews/flir-e4-the-useful-information-thread/)
 
Flir Tools http://www.flir.com/thermography/americas/us/view/?id=54865 (http://www.flir.com/thermography/americas/us/view/?id=54865)

Direct (non-registration required) link to Flir RNDIS driver http://cdn.cloud.flir.se/swdownload/assets/other/flir_device_drivers.exe (http://cdn.cloud.flir.se/swdownload/assets/other/flir_device_drivers.exe)

Tech notes documenting network modes using RNDIS http://www.imc-store.com.au/v/vspfiles/assets/images/flir%20a310%20technical%20notes.pdf (http://www.imc-store.com.au/v/vspfiles/assets/images/flir%20a310%20technical%20notes.pdf)

Info on console commands etc. http://support.flir.com/DocDownload/Assets/75/English/T559504$A.pdf (http://support.flir.com/DocDownload/Assets/75/English/T559504$A.pdf)


There is  lots of other useful info in this thread so well worth a read.

Yes, it has a 320x240 60fps sensor - same as the £4700 E8 model and even more expensive Ex0 series
FLIR E4 Thermal Imaging Camera teardown (http://www.youtube.com/watch?v=NtqUE67BUDI#)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on October 13, 2013, 08:24:14 pm
Perfect timing sir!  :-+ I just got me some tea + fresh banana bread!

*watches*
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 13, 2013, 08:51:35 pm
Thanks Mike,

Something interesting to watch on a Sunday morning, rather than 'Sunday Brunch' on Channel 4 !

Fraser

UPDATE:

I have posted a UK supplier recommendation here

http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg328110/#msg328110 (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg328110/#msg328110)

Message  #1109

The company is willing to offer a discount to EEVBlog members.


UPDATE:

I have created an E4 'Useful information' thread here:

http://www.eevblog.com/forum/reviews/flir-e4-the-useful-information-thread/ (http://www.eevblog.com/forum/reviews/flir-e4-the-useful-information-thread/)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: niflheimer on October 13, 2013, 09:14:49 pm
Just watched it - impressive how they've managed to reduce both the BOM and the cost of the sensor. I wouldn't be surprised if the only things different on the other models are the add-on boards for wifi/BT and a slightly different firmware and caps table.

The X-ray is new though - film type ?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: M. András on October 13, 2013, 09:52:51 pm
another software locked hardware i see :)  wonder what it actually cost  to sell the same thing for cheaper than the advanced optioned ones
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 13, 2013, 10:04:35 pm
Mike,

Another excellent video. thank you. I have commented in the other thread but I noted the 2009 micro-bolometer date. The FLIR TAU engine is looking like a more likely candidate than ever. It's relatively old, so development costs have likely been recovered, and this is just stripping it back to basics for usage in consumer grade products. Sadly I cannot find any internal pictures of the TAU.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Hypernova on October 13, 2013, 10:23:31 pm
Oh man, imagine if we can change the limitation just by rewriting the EEPROM!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: amyk on October 13, 2013, 11:14:39 pm
:-+ :-+ Excellent video!

I would've pulled on the various different-coloured parts of the "snout" first before putting more force into the button. The x-ray didn't reveal those screws behind the snout?

At 30:08 you can see Mg marked on the frame so it very clearly is magnesium. The exposed bond wires were unexpected and disturbingly fragile; I'm a little surprised they didn't encapsulate them with epoxy like a COB, although that might have something to do with the thermal requirements.

The CPU has an Ethernet interface - maybe it's broken out on one of the pads.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: alm on October 14, 2013, 01:11:19 am
Mike commented on this the first time he discussed the PCB.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on October 14, 2013, 01:14:17 am
Oh , I was wondering g what that little cutout on the pcb was!
Thermal sensor.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 14, 2013, 02:38:46 am
Mike,

Another excellent video. thank you. I have commented in the other thread but I noted the 2009 micro-bolometer date. The FLIR TAU engine is looking like a more likely candidate than ever. It's relatively old, so development costs have likely been recovered, and this is just stripping it back to basics for usage in consumer grade products. Sadly I cannot find any internal pictures of the TAU.
I'd love to know how much the cheapest Tau costs - could be some scope for hacking there - chances are it has the same datastream inside
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mos6502 on October 14, 2013, 09:47:18 am
The Tau 640 is around 10k ... maybe you can interpolate from that.

Problem with the Tau is that they fall under the ITAR regluations ... dunno if they even talk to you unless you're an international corporation.

BTW, excellent videos Mike. I love 'em.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: zapta on October 14, 2013, 09:47:44 am
Dave, have you considered to include great teardown videos like this one in your official eevblog? 

You can have a short introduction and summary as a host and have the guest's  contributed video in between.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Noize on October 14, 2013, 10:10:25 am
Is the x-ray machine from the luggage scanner that you had? I thought that you had sold it? Love to have one of those!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 14, 2013, 10:12:12 am
Is the x-ray machine from the luggage scanner that you had? I thought that you had sold it? Love to have one of those!
No it's a mailroom x-ray I picked up a while ago. Have shot half a teardown but not got round to finishing
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Hypernova on October 14, 2013, 06:11:21 pm
Maybe someone who know more about this can chime in but doesn't exposing the die present a major failure point from corrosion?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Stonent on October 14, 2013, 07:10:49 pm
Is the x-ray machine from the luggage scanner that you had? I thought that you had sold it? Love to have one of those!
No it's a mailroom x-ray I picked up a while ago. Have shot half a teardown but not got round to finishing

I had just figured you scrapped as much of the metal as you could and condensed the unit, but now that I think about it, the luggage xray was made to be in motion and this one was still.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: l3iggs on October 15, 2013, 03:25:42 am
Hey Mike, thanks for taking the time to put together a very interesting tear down. Have you attempted to coax the data stream out of the sensor module without the main board attached?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 15, 2013, 04:09:30 am
Hey Mike, thanks for taking the time to put together a very interesting tear down. Have you attempted to coax the data stream out of the sensor module without the main board attached?
No but may look at some point -My guess is FPGA could be generating some of the timing signals. Will probably need to make a riser adapter to get at the pins though - need to see if I can ID and obtain the board-board connectors.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: firewalker on October 15, 2013, 07:06:53 am
X-raing the sensor could reveal something?

Alexander.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 15, 2013, 07:08:39 am
X-raing the sensor could reveal something?

Alexander.
Yes but unfortunately my x-ray doesn't have the resolution.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Stonent on October 15, 2013, 06:23:25 pm
X-raing the sensor could reveal something?

Alexander.
Yes but unfortunately my x-ray doesn't have the resolution.

It would be interesting to xray it while it was on and capture the video from the flir.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: algorath on October 16, 2013, 12:36:27 am
great video as always. and yes, your trigger torturing really did hurt hehe
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tesla500 on October 16, 2013, 04:16:26 am
Can you try using another thermal camera to look through the top window of the E4's sensor?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 16, 2013, 04:18:15 am
Can you try using another thermal camera to look through the top window of the E4's sensor?
I did try but close-focus on my other TIC isn't good enough to see anything
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 16, 2013, 05:11:26 am
Such thermal investigation would be a challenge as the temperature differential inside the Micro-bolometer FPA is intentionally very small. The sensing elements do not produce heat. The resolution of the FireFlIR (320x240) is also too low for die detail, even when using a close-up lens.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tesla500 on October 16, 2013, 05:32:18 am
Such thermal investigation would be a challenge as the temperature differential inside the Micro-bolometer FPA is intentionally very small. The sensing elements do not produce heat. The resolution of the FireFlIR (320x240) is also too low for die detail, even when using a close-up lens.

Yes, but you could potentially hold a "light" (soldering iron?) over it and see differences in thermal reflectivity on the microbolometer.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 16, 2013, 06:29:37 am
Next time I have it apart, I will try with a halogen lamp
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mamalala on October 16, 2013, 07:12:34 am
Next time I have it apart, I will try with a halogen lamp

If needed, i can send you a 600W HPS plus ballast. That should give you enough heat and light  :-DD

Greetings,

Chris
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 19, 2013, 01:06:21 am


I found an interesting and enlightening document on Microbolometer design that had Inframetrics input. I have placed it under its own heading here:

http://www.eevblog.com/forum/projects/thermal-imaging-camera-microbolometer-design-detail/msg312455/#msg312455 (http://www.eevblog.com/forum/projects/thermal-imaging-camera-microbolometer-design-detail/msg312455/#msg312455)

Fraser
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 19, 2013, 09:30:48 am
How exactly did you get the serial boot data off of the E4? Which pins, and with what PC adapter? Which serial format was it in?
38K4 baud on a pin on the unused FFC connector - I've not had time yet to figure out all the pins, but I2C, CPU reset and power button are on there.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 19, 2013, 08:02:56 pm
Pins I know so far - all I've done so far is test for input/output using pullup/pulldown resistor
 4 & 6 look good candidates for serial in.
Logic levels are 3.3v
Starting from end nearest to the unpopulated FFC connector
1 On/Off switch (to ground)
2 Power - Vbattery during run and charge - possibly via a FET switch as I didn't see continuity to bat terminal
3 Output
4 Input
5 Serial TXD 38K4
6 Input
7 0V
8 /Reset
9  Output
10 Input
11 Output
12 Input
13 Input
14 I2C SDA
15 I2C SCL
16 0V

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 20, 2013, 01:21:14 am
Someone emailed me last week with info on hacking the i series but was very wary of releasing - apparently there is a power-up key combination that gets you into a config screen, from which you can enable networking and do stuff like changing the resolution of i3 to i7, disabling the text overlay and reducing display noise - don't have it to hand ATM but I think it was something like holding play+down key at startup.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: BravoV on October 20, 2013, 01:58:04 am
Damn, this is getting intense, sub'd, thanks Mike !  :-+
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on October 20, 2013, 02:25:53 am
Edit: wrote I4 accidentely - I now corrected it to I3.

OHHHHH - if hacking an I3->I7 would be possible, I would purchase a I3 right away.
I doubt that hacking could be so unbelievable easy but  if Mike confirms during the weekend that there is a keyboard combination for enhancing resolution to 140x140 I am going to order one on monday.

The decision would be the same for me as with the Rigol product: only because of the available hacks I purchased DS2072 & DSA815-TG & DG4062: I am willing to spend some money for decent functionality but price/functionality- relation has to be a really good one.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 20, 2013, 03:05:18 am
Edit: wrote I4 accidentely - I now corrected it to I3.

OHHHHH - if hacking an I3->I7 would be possible, I would purchase a I3 right away.

Might be worth waiting to see what's possible on the E4, unless i3's are being heaviliy discounted. And no, I don't know anything yet before you ask, but haven't started seriously looking yet. 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 20, 2013, 03:07:17 am
Maybe worth splitting i-series discussion to a different thread to avoid confusion?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 20, 2013, 05:21:03 am
We could almost do with a Thermal camera section on its own....there is a lot of interest in these units and mush fun to be had with them  ;)

I thought about starting a thread that will contain pictures taken of electronics using such units to show what is possibkle with teh different models and resolutions.

I would support the i series hacking or investigations being in a separate thread to avoid too much criss crossing within the flow of conversations.

I feel sure that there will be many interested in the whole range of topics and Mike has already proven that many wish to know what 'magic' goes on inside the modern TIC.

All very interesting and informative stuff  :-+
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: amyk on October 20, 2013, 07:10:33 pm
At a glance there are a ton more DMM and scope threads than TICs, and they don't get their own section...
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 20, 2013, 08:45:37 pm
But DMMs and scopes are BORING in comparison !  :-DD
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 20, 2013, 09:01:15 pm
So if you hold the 'load' button down during startup.....
Quote
Bootloader 16.3 for ASCO (May  6 2013 11:41:42)
PMIC wake up: R5=40h E_SEQ_RDY  R6=1h E_nONKEY
PMIC status:  R1=1h nONKEY  R2=a0h COMP_DET GP_FB2
Fuel gauge check: res=1, voltage=3704
Reset reason (0x00000000): Power ON

Press [ENTER] to force OS/FS image update (MSD) or [SPACE] to cancel.

Initiating image update in 0 seconds.
Launching flash image  ...
+InitSpecifiedEthDevice
INFO: Trying to initialize the built-in USB/MSD...
MSD:: initialization
MSD: USB initialization completed

..and if you then plug it into the PC
Quote
USB Attach: High speed
Appears as a drive, but just a couple of uninteresting text files - probably looking for a firmware file to be saved

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 20, 2013, 09:24:55 pm
..and if you send a <space> to the UART during boot....
<quote>
SETTINGS:
0) IP address: 0.0.0.0
1) Subnet Mask: 0.0.0.0
2) Boot delay: 1 seconds
3) DHCP: Enabled
4) Reset to factory default configuration
5) Autoboot: NK from NOR
6) MAC address: 00:40:7F:0B:91:39
7) Host connection: (USB MSD)

ACTIONS:
S) Save configuration
D) Download image now
L) Launch existing flash image now
R) Launch existing flash image now in SAFE (restricted) mode
E) Erase flash file system area
B) Erase OS Image area
</quote>
Option 7 may be intersting - options are USB BSD, ETHERNET and USB RNDIS, which provides virtual ethernet over USB - fairly sure the latter is what enabled the i7 hack - unfortunately I've lost the email I had about that.
Safe mode doesn't do anything interesting
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 20, 2013, 10:01:06 pm
Oh Mike.....you LOST the hack email   :palm:

Or did you hear the distinctive thump-thump-thump of the black helicopters rotors overhead ?  :scared:

If you ask GCHQ or the NSA nicely, they may provide you with their copy of the email  :-DD
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 20, 2013, 10:23:01 pm
Oh Mike.....you LOST the hack email   :palm:

Or did you hear the distinctive thump-thump-thump of the black helicopters rotors overhead ?  :scared:

If you ask GCHQ or the NSA nicely, they may provide you with their copy of the email  :-DD
Yep - hard disk on that laptop was failing around the time I got it - have tried to recover but no joy so far - may still be in there somewhere..

However.....
If you download the Ex firmware from Flir, and rename the .fif file to .cab  Many very interesting things appear.... Will take some time to examine....
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 20, 2013, 10:31:44 pm
This looks interesting....
Quote
Restarting in high resolution mode/service mode
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: amyk on October 20, 2013, 10:40:36 pm
Especially after seeing those erase options I hope you've dumped the flash image and stored it in a safe place for backup... for recovering from any accidental bricking. One of the first things I do when RE'ing a device is try to get a complete firmware image.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 20, 2013, 11:05:24 pm
Ahhhh, the infamouse computer hard disk crash..... what you have to ask yourself is.....did it just 'die' or was it Killed by the Dark Net  >:D

With regard to the proding of the firmware in your camera.  A back-up would be prudent if possible as from what I have learn't each camera is calibrated, and the calibration data is vital to correct image appearance. My PM570 has this important Microbolometer calibration data on the same Flash chip as the OS firmware. It uses a block addressable 28F16 for all its Flash storage needs.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 21, 2013, 02:41:33 am
oooh look - I found another serial port...
Code: [Select]
List of all available commands (+ description)

  command /?     For more information on a specific command

?        List all available commands without description).
ALIAS    Sets, removes or shows aliases.
ATTRIB   Displays or changes file attributes.
BEEP     Beep the speaker.
CALL     Calls one batch program from another.
CD       Displays the name of or changes the current directory.
CHOICE   Waits for the user to choose one of a set of choices.
CLS      Clears the screen.
CMD      Starts a new instance of the FLIR command line interpreter.
COPY     Copies one or more files to another location.
DATE     Displays or sets the date.
DELETE   Deletes one or more files.
DIR      Displays a list of files and subdirectories in a directory.
ECHO     Displays messages, or turns command echoing on or off.
ERASE    Deletes one or more files.
EXIT     Quits the CMD.EXE program (command interpreter).
FOR      Runs a specified command for each file in a set of files.
FREE     (free) disc space.
GOTO     Directs the FLIR command line interpreter to a labeled line in
         a batch program.
HELP     Provides Help information for FLIR commands.
HISTORY  List all commands which has been used
IF       Performs conditional processing in batch programs.
MD       Creates a directory.
MKDIR    Creates a directory.
MOVE     Moves one or more files from one directory to another
         directory.
PATH     Displays or sets a search path for executable files.
PAUSE    Suspends processing of a batch file and displays a message.
POPD     Restores the previous value of the current directory saved by
         PUSHD.
PROMPT   Changes the command prompt.
PUSHD    Saves the current directory then changes it.
RD       Removes a directory.
REM      Records comments (remarks) in batch files.
REN      Renames a file or files.
RENAME   Renames a file or files.
REPLACE  Replaces files.
RMDIR    Removes a directory.
SCREEN   Move cursor and optionally print text.
SET      Displays, sets, or removes FLIR command line interpreter environment va
riables.
SHIFT    Shifts the position of replaceable parameters in batch files.
START    Starts a separate window to run a specified program or command.
         Executes command.
TIME     Displays or sets the system time.
TIMER    Allow the use of ten stopwatches.
TYPE     Displays the contents of a text file.
VER      Displays the FLIR command line interpreter and Windows CE version.

\>
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 21, 2013, 02:51:09 am
Entry point into the command line for the Embedded Win CE computer ?.
Now how to extract and edit the boot batch files to change some settings  >:D
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 21, 2013, 03:19:49 am
Looks like a boot filesystem and a 'working' one. Tons of config/cal data. Looks like model assignment may be baked into the cal process to some extent.

Looking to see if I can copy files between the flash Filesystem and the filesystem that's visible through the USB. Any 
CE experts out there?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 21, 2013, 05:17:13 am
I just remembered something about WinCE not being able to access a volume when it was mounted via USB.
Once USB unplugged, you get another folder in the root directory - FlashIFS, so you can copy stuff on & off the device via this..!
http://youtu.be/sN3WK3IpH6E (http://youtu.be/sN3WK3IpH6E)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on October 21, 2013, 05:33:21 am
Love the new boot splash!  ;D

And that other serial port also looks pretty damn interesting.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 21, 2013, 05:36:10 am
This looks important....
Code: [Select]
\flashfs\system\appcore.d\config.d>type conf.cfg
#
# Generated at 2013-06-12 14:30:34
#
.caps entry
.caps.config entry
.caps.config.name text "app E4"
.caps.config.revision text "1.0"
.caps.config.image entry
.caps.config.image.framegrab entry
.caps.config.image.framegrab.fusion entry
.caps.config.image.framegrab.fusion.enabled bool true
.caps.config.image.framegrab.fusion.pip entry
.caps.config.image.framegrab.fusion.pip.enabled bool true
.caps.config.image.framegrab.fusion.hcf entry
.caps.config.image.framegrab.fusion.hcf.enabled bool true
.caps.config.image.services entry
.caps.config.image.services.store entry
.caps.config.image.services.store.enabled bool true
.caps.config.image.services.store.radiometric entry
.caps.config.image.services.store.radiometric.enabled bool true
.caps.config.image.services.store.incompatible entry
.caps.config.image.services.store.incompatible.enabled bool false
.caps.config.image.services.store.incompatible.level int32 0
.caps.config.image.settings entry
.caps.config.image.settings.enabled bool true
.caps.config.image.settings.IRwidth int32 80
.caps.config.image.settings.IRheight int32 60
.caps.config.image.sysimg entry
.caps.config.image.sysimg.alarms entry
.caps.config.image.sysimg.alarms.enabled bool false
.caps.config.image.sysimg.alarms.measfunc entry
.caps.config.image.sysimg.alarms.measfunc.enabled bool false
.caps.config.image.sysimg.alarms.measfunc.maxCount int32 3
.caps.config.image.sysimg.alarms.humidity entry
.caps.config.image.sysimg.alarms.humidity.enabled bool false
.caps.config.image.sysimg.alarms.humidity.maxCount int32 1
.caps.config.image.sysimg.alarms.insulation entry
.caps.config.image.sysimg.alarms.insulation.enabled bool false
.caps.config.image.sysimg.alarms.insulation.maxCount int32 1
.caps.config.image.sysimg.irMarkers entry
.caps.config.image.sysimg.irMarkers.enabled bool false
.caps.config.image.sysimg.irMarkers.spot entry
.caps.config.image.sysimg.irMarkers.spot.enabled bool false
.caps.config.image.sysimg.irMarkers.spot.maxCount int32 0
.caps.config.image.sysimg.irMarkers.arrow entry
.caps.config.image.sysimg.irMarkers.arrow.enabled bool false
.caps.config.image.sysimg.irMarkers.arrow.maxCount int32 0
.caps.config.image.sysimg.irMarkers.box entry
.caps.config.image.sysimg.irMarkers.box.enabled bool false
.caps.config.image.sysimg.irMarkers.box.maxCount int32 0
.caps.config.image.sysimg.measureFuncs entry
.caps.config.image.sysimg.measureFuncs.enabled bool true
.caps.config.image.sysimg.measureFuncs.diff entry
.caps.config.image.sysimg.measureFuncs.diff.enabled bool false
.caps.config.image.sysimg.measureFuncs.diff.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.diff.calcMask int32 65526
.caps.config.image.sysimg.measureFuncs.isotherm entry
.caps.config.image.sysimg.measureFuncs.isotherm.enabled bool false
.caps.config.image.sysimg.measureFuncs.isotherm.calcMask int32 20
.caps.config.image.sysimg.measureFuncs.isotherm.dual bool false
.caps.config.image.sysimg.measureFuncs.isotherm.fixScale bool false
.caps.config.image.sysimg.measureFuncs.isotherm.interval bool false
.caps.config.image.sysimg.measureFuncs.isotherm.invInterval bool false
.caps.config.image.sysimg.measureFuncs.isotherm.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.mbox entry
.caps.config.image.sysimg.measureFuncs.mbox.enabled bool false
.caps.config.image.sysimg.measureFuncs.mbox.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mbox.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.mcircle entry
.caps.config.image.sysimg.measureFuncs.mcircle.enabled bool false
.caps.config.image.sysimg.measureFuncs.mcircle.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mcircle.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.mline entry
.caps.config.image.sysimg.measureFuncs.mline.enabled bool false
.caps.config.image.sysimg.measureFuncs.mline.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mline.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.reftemp entry
.caps.config.image.sysimg.measureFuncs.reftemp.enabled bool false
.caps.config.image.sysimg.measureFuncs.reftemp.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.reftemp.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.script entry
.caps.config.image.sysimg.measureFuncs.script.enabled false
.caps.config.image.sysimg.measureFuncs.script.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.spot entry
.caps.config.image.sysimg.measureFuncs.spot.enabled bool true
.caps.config.image.sysimg.measureFuncs.spot.calcMask int32 514
.caps.config.image.sysimg.measureFuncs.spot.maxCount int32 1
.caps.config.image.sysimg.visualMarkers entry
.caps.config.image.sysimg.visualMarkers.enabled bool false
.caps.config.image.sysimg.visualMarkers.spot entry
.caps.config.image.sysimg.visualMarkers.spot.enabled bool false
.caps.config.image.sysimg.visualMarkers.spot.maxCount int32 0
.caps.config.image.sysimg.visualMarkers.arrow entry
.caps.config.image.sysimg.visualMarkers.arrow.enabled bool false
.caps.config.image.sysimg.visualMarkers.arrow.maxCount int32 0
.caps.config.image.sysimg.visualMarkers.box entry
.caps.config.image.sysimg.visualMarkers.box.enabled bool false
.caps.config.image.sysimg.visualMarkers.box.maxCount int32 0
.caps.config.image.contadj entry
.caps.config.image.contadj.minSpanFactor entry
.caps.config.image.contadj.minSpanFactor.enabled bool true
.caps.config.image.contadj.minSpanFactor.factorAuto double 2.0
.caps.config.image.contadj.minSpanFactor.factorManual double 2.0
.caps.config.image.targetNoise entry
.caps.config.image.targetNoise.enabled bool true
.caps.config.image.targetNoise.targetNoiseMk int32 135
.caps.config.image.zoom entry
.caps.config.image.zoom.enabled bool false
.caps.config.image.zoom.maxFactor double 1
.caps.config.system entry
.caps.config.system.focus entry
.caps.config.system.focus.laser entry
.caps.config.system.focus.laser.updateFocus entry
.caps.config.system.focus.laser.updateFocus.enabled bool false
.caps.config.ui entry
.caps.config.ui.fusion entry
.caps.config.ui.fusion.PIP entry
.caps.config.ui.fusion.PIP.enabled bool false
.caps.hw entry
.caps.hw.sdcard entry
.caps.hw.sdcard.enabled bool false
# ID 63903771
# CRC01 f032b591
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 21, 2013, 05:42:15 am
..and this similar but interestingly different file in a "service" directory, could be handy if it's looking at the CRCs.
Code: [Select]
# Generated at CONFIG_DATE CONFIG_TIME
#
.caps entry
.caps.config entry
.caps.config.name text "app prodconvconf_std"
.caps.config.revision text "999.9KaKaOnly"
.caps.config.image entry
.caps.config.image.framegrab entry
.caps.config.image.framegrab.fusion entry
.caps.config.image.framegrab.fusion.enabled bool true
.caps.config.image.sensor entry
.caps.config.image.sensor.enabled bool true
.caps.config.image.services entry
.caps.config.image.services.store entry
.caps.config.image.services.store.enabled bool true
.caps.config.image.services.store.radiometric entry
.caps.config.image.services.store.radiometric.enabled bool true
.caps.config.image.services.store.incompatible entry
.caps.config.image.services.store.incompatible.enabled bool false
.caps.config.image.services.store.incompatible.level int32 0
.caps.config.image.settings entry
.caps.config.image.settings.enabled bool true
.caps.config.image.settings.IRheight int32 240
.caps.config.image.settings.IRwidth int32 320
.caps.config.image.sysimg entry
.caps.config.image.sysimg.alarms entry
.caps.config.image.sysimg.alarms.enabled bool true
.caps.config.image.sysimg.alarms.measfunc entry
.caps.config.image.sysimg.alarms.measfunc.enabled bool true
.caps.config.image.sysimg.alarms.measfunc.maxCount int32 3
.caps.config.image.sysimg.alarms.humidity entry
.caps.config.image.sysimg.alarms.humidity.enabled bool true
.caps.config.image.sysimg.alarms.humidity.maxCount int32 1
.caps.config.image.sysimg.alarms.insulation entry
.caps.config.image.sysimg.alarms.insulation.enabled bool true
.caps.config.image.sysimg.alarms.insulation.maxCount int32 1
.caps.config.image.sysimg.irMarkers entry
.caps.config.image.sysimg.irMarkers.enabled bool true
.caps.config.image.sysimg.irMarkers.spot entry
.caps.config.image.sysimg.irMarkers.spot.enabled bool false
.caps.config.image.sysimg.irMarkers.spot.maxCount int32 0
.caps.config.image.sysimg.irMarkers.arrow entry
.caps.config.image.sysimg.irMarkers.arrow.enabled bool true
.caps.config.image.sysimg.irMarkers.arrow.maxCount int32 4
.caps.config.image.sysimg.irMarkers.box entry
.caps.config.image.sysimg.irMarkers.box.enabled bool false
.caps.config.image.sysimg.irMarkers.box.maxCount int32 0
.caps.config.image.sysimg.measureFuncs entry
.caps.config.image.sysimg.measureFuncs.enabled bool true
.caps.config.image.sysimg.measureFuncs.diff entry
.caps.config.image.sysimg.measureFuncs.diff.enabled bool true
.caps.config.image.sysimg.measureFuncs.diff.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.diff.calcMask int32 65526
.caps.config.image.sysimg.measureFuncs.isotherm entry
.caps.config.image.sysimg.measureFuncs.isotherm.enabled bool true
.caps.config.image.sysimg.measureFuncs.isotherm.calcMask int32 20
.caps.config.image.sysimg.measureFuncs.isotherm.dual bool false
.caps.config.image.sysimg.measureFuncs.isotherm.fixScale bool false
.caps.config.image.sysimg.measureFuncs.isotherm.interval bool true
.caps.config.image.sysimg.measureFuncs.isotherm.invInterval bool false
.caps.config.image.sysimg.measureFuncs.isotherm.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.mbox entry
.caps.config.image.sysimg.measureFuncs.mbox.enabled bool true
.caps.config.image.sysimg.measureFuncs.mbox.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mbox.maxCount int32 5
.caps.config.image.sysimg.measureFuncs.mcircle entry
.caps.config.image.sysimg.measureFuncs.mcircle.enabled bool false
.caps.config.image.sysimg.measureFuncs.mcircle.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mcircle.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.mline entry
.caps.config.image.sysimg.measureFuncs.mline.enabled bool false
.caps.config.image.sysimg.measureFuncs.mline.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mline.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.reftemp entry
.caps.config.image.sysimg.measureFuncs.reftemp.enabled bool true
.caps.config.image.sysimg.measureFuncs.reftemp.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.reftemp.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.script entry
.caps.config.image.sysimg.measureFuncs.script.enabled false
.caps.config.image.sysimg.measureFuncs.script.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.spot entry
.caps.config.image.sysimg.measureFuncs.spot.enabled bool true
.caps.config.image.sysimg.measureFuncs.spot.calcMask int32 514
.caps.config.image.sysimg.measureFuncs.spot.maxCount int32 5
.caps.config.image.sysimg.visualMarkers entry
.caps.config.image.sysimg.visualMarkers.enabled bool true
.caps.config.image.sysimg.visualMarkers.spot entry
.caps.config.image.sysimg.visualMarkers.spot.enabled bool false
.caps.config.image.sysimg.visualMarkers.spot.maxCount int32 0
.caps.config.image.sysimg.visualMarkers.arrow entry
.caps.config.image.sysimg.visualMarkers.arrow.enabled bool true
.caps.config.image.sysimg.visualMarkers.arrow.maxCount int32 4
.caps.config.image.sysimg.visualMarkers.box entry
.caps.config.image.sysimg.visualMarkers.box.enabled bool false
.caps.config.image.sysimg.visualMarkers.box.maxCount int32 0
.caps.config.image.targetNoise entry
.caps.config.image.targetNoise.enabled bool false
.caps.config.image.targetNoise.targetNoiseMk int32 0
.caps.config.image.zoom entry
.caps.config.image.zoom.enabled bool true
.caps.config.image.zoom.maxFactor double 8
.caps.config.system entry
.caps.config.system.focus entry
.caps.config.system.focus.laser entry
.caps.config.system.focus.laser.updateFocus entry
.caps.config.system.focus.laser.updateFocus.enabled bool true
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: bean_dip on October 21, 2013, 05:42:52 am
This looks important....

Ooo...that does look important.  I had been looking through the update I downloaded from the FLIR website, but that folder is not included.  I did find this while trying to disassemble the .exe's in the firware...  Hopefully when my E4 arrives I'll be able to help more (ordered yesterday after convincing myself that it could one day be an E8).

Code: [Select]
usage: gethwtype [-h] [-v]
   -h   Help, show this text
   -v   verbose, show additional info

Identifies FLIR hardware that this utility runs on


Shows hardware as: <type><subtype>


Known hardwares:

Qx - unknown HW.
H1 - Fire camera
Y1 - T-MkII(Ylva) camera
Z3 - ASCO camera
Z2 - IVCO or ZOCO_BLUE camera
Z1 - ZOCO camera
S1 - SART camera
F1 - Liston camera
T1 - PT camera
R1 - A2 camera
X1 - Ixx
G1 - GF
P2 - P-Cam, BACP2
P1C- P-Cam, BACP rev >=08, UIP rev>=05
P1B- P-Cam, BACP rev >=08, UIP rev 03/04
P1A- P-Cam, BACP rev 07
A5B- A-Cam S, AHCO3 AND SB0601 30 Hz detector
A5A- A-Cam S, AHCO3 AND SB0601 9 Hz detector
A4B- A-Cam R, AHCO AND SB0601 30 Hz detector
A4A- A-Cam R, AHCO AND SB0601 9 Hz detector
A3B- A-Cam S, AHCO AND SB0601 30 Hz detector
A3A- A-Cam S, AHCO AND SB0601 9 Hz detector
A2B- A-Cam R, AHCO AND SB040 30 Hz detector
A2A- A-Cam R, AHCO AND SB040 9 Hz detector
A1B- A-Cam S, AHCO AND SB0401 30 Hz detector
A1A- A-Cam S, AHCO AND SB0401 9 Hz detector
Ex - T-Cam, unknown subtype (remote)
E4 - T-Cam, BACT2 AND ULIS detector
E3B- T-Cam, BACT2 AND SB0601 30 Hz detector
E3A- T-Cam, BACT2 AND SB0601 9 Hz detector
E2B- T-Cam, BACT AND SB0601 30 Hz detector
E2A- T-Cam, BACT AND SB0601 9 Hz detector
E1B- T-Cam, BACE rev 04-07 AND SB0401 30Hz
E1A- T-Cam, BACE rev 04-07 AND SB0401 9 Hz
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 21, 2013, 05:54:18 am
I don't need an E4 (or an E8) but I am rivetted to this thread. I love it when someone with a decent brain penetrates the OS of a sytem to increase its capabilities. Its like some sort of 'Black Op'  :-+

Great work Mike and you may get some additional help with Beaan-dip also working on the challenge.  :)

My FLIR PM5xx and 6xx series TIC's also have two serial ports. One for remote control, and one dedicated to factory use. I shall have to give the factory port a poke to see what is there  :)

I am not as skilled in this area as Mike but I would be interested to see whether I can enable the (already fitted) high temperaturefilter on my cameras. It just needs a software change to set it to 'present'. The menu then permits its use. I had better repair my remaining project unit first though.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 21, 2013, 06:21:13 am
Quote
Ooo...that does look important.  I had been looking through the update I downloaded from the FLIR website, but that folder is not included.

It appears that the contents of flashfs are created at factory test/cal time.,and comprise a ton of config & cal data
flashBFS seems to be system, which looks like what is in the update file.
The file creation dates are also interesting.

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 21, 2013, 06:35:21 am
Oops!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 21, 2013, 06:58:14 am
Editing that conf.cfg file doesn't seem to do anything...  :(
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 21, 2013, 07:01:44 am
Quote
usage: gethwtype [-h] [-v]

Z3 - ASCO camera

returns Z3
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: bean_dip on October 21, 2013, 07:08:06 am
Editing that conf.cfg file doesn't seem to do anything...  :(

I wonder if this has anything to do with it... from /system/combtabs.d/combtab.appkit:

Code: [Select]
# combtab file for Astra
# This file should be present as different filenames in
# appkit, prodkit and OS project directory
TYPE combtab
#unique file identifier
DATE 2013-08-14
# Newest date for any combtab file identifies file to use.
# We cannot rely on file date because that might change when transfering files
KITS osimgkit, appkit, prodkit
# KITS line identifies resource branch for columns used in file. comma separated.
SHORT os, appkit, prodkit
# SHORT line identifies kits in the concatenated fullver resource. comma separated.
COMBINATIONS
# this line identifies that table starts.
# table lines comma separated as KITS above
# KITS osimgkit, appkit, prodkit
0.1.1, 1.0.1, 0.1.0, 0.1.0.1
0.2.2, 1.0.3, 0.2.0, 0.1.0.2
0.3.3, 1.0.5, 0.3.0, 0.1.0.3
0.4.3, 1.0.7, 0.3.0, 0.1.0.3
0.5.3, 1.0.7, 0.4.0, 0.1.0.3
0.5.4, 1.0.7, 0.4.0, 0.1.0.4
0.6.5, 1.0.9, 0.5.0, 0.1.0.5
0.7.6, 1.0.11, 0.6.0, 0.1.0.6
0.8.7,  1.0.11, 0.6.1,  0.6.1.7
0.9.7,  1.0.11, 0.6.2,  0.6.1.7
0.10.8,  1.0.11, 0.6.3,  0.6.1.8
0.11.8,  1.0.13, 0.6.3,  0.6.1.8
0.12.8,  1.0.13, 0.6.4,  0.6.1.8
0.13.8,  1.0.13, 0.6.5,  0.6.1.8
0.13.9,  1.0.13, 0.6.5,  0.6.1.9
0.14.9,  1.0.15, 0.6.5,  0.6.1.9
0.15.9,  1.0.15, 0.6.6,  0.6.1.9
0.15.10,  1.0.15, 0.6.6, 0.6.1.10
0.16.10,  1.0.17, 0.6.6, 0.6.1.10
0.17.10,  1.0.17, 0.6.7, 0.6.1.10
0.17.11,  1.0.17, 0.6.7, 0.6.1.11
0.18.11,  1.0.19, 0.6.7, 0.6.1.11
0.19.11,  1.0.19, 0.6.8, 0.6.1.11
0.19.12,  1.0.19, 0.6.8, 0.6.1.12
0.20.12,  1.0.21, 0.6.8, 0.6.1.12
0.21.12,  1.0.21, 0.6.9, 0.6.1.12
0.21.13,  1.0.21, 0.6.9, 0.6.1.13
0.22.13,  1.0.21, 0.6.10, 0.6.1.13
0.23.13,  1.0.23, 0.6.10, 0.6.1.13
1.0.1, 16.0.0, 1.0.0, 1.0.0.1
1.1.1, 16.0.2, 1.0.0, 1.0.0.1
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ixfd64 on October 21, 2013, 07:12:17 am
Maybe all of this could convince the thermal camera makers to reduce their prices. I can dream, right? ;D
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 21, 2013, 07:19:21 am
Nope, it will teach them to install security in their design to prevent such firmware analysis  ;)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ixfd64 on October 21, 2013, 07:25:44 am
That kind of reminds me of when Texas Instruments went after graphing calculator hobbyists for breaking their signing keys (https://en.wikipedia.org/wiki/Texas_Instruments_signing_key_controversy). It didn't end too well (https://en.wikipedia.org/wiki/Streisand_effect) for the company.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 21, 2013, 07:26:22 am
Digging around UI files in the FW update suggests a hidden menu.
 
Quote
  <ui_model type="RetailModeSettingsModel" name="retailModeSettingsModel">
    <ui_model_item type="SettingItem" ID="OFF" label="ID_RETAIL_OFF" radio="true"/>
    <ui_model_item type="SettingItem" ID="ELECTRICAL" label="ID_RETAIL_ELECTRICAL_APPLICATIONS" radio="true"/>
    <ui_model_item type="SettingItem" ID="BUILDING" label="ID_RETAIL_BUILDING_APPLICATIONS" radio="true"/>
  </ui_model>

<ui_model type="HiddenServiceSettingsModel" name="hiddenServiceSettingsModel">
    <ui_model_item type="SettingItem" ID="USB_MODE" label="ID_SETUP_USB_MODE"

nextModel="usbModeSettingsModel" nextQML="SettingsPage.qml" settingType="entry" />
    <ui_model_item type="SettingItem" ID="EXPORT_INFO" label="ID_SETUP_EXPORT_INFO" />

    <ui_model_item type="SettingItem" ID="VERSION_INFO" label="ID_SETUP_VERSION_INFO" nextModel="versionSettingsModel" nextQML="SettingsPage.qml" settingType="entry" />
  </ui_model>
Quote
  <ui_model type="USBModeSettingsModel" name="usbModeSettingsModel">
    <ui_model_item type="SettingItem" ID="MSD" label="MSD" radio="true"/>
    <ui_model_item type="SettingItem" ID="UVC" label="UVC" radio="true"/>
    <ui_model_item type="SettingItem" ID="RNDIS" label="RNDIS" radio="true" />
    <ui_model_item type="SettingItem" ID="RNDIS_UVC" label="RNDIS and UVC" radio="true"/>
    <ui_model_item type="SettingItem" ID="RNDIS_MSD" label="RNDIS and MSD" radio="true"/>
    <ui_model_item type="SettingItem" ID="UVC_MSD" label="UVC and MSD" radio="true" />
    <ui_model_item type="SettingItem" ID="RNDIS_UVC_MSD" label="RNDIS, UVC and MSD" radio="true"/>
  </ui_model>
I believe RNDIS is the critical thing - from what I recall from the i7 email it allows virtual networking to either TELNET or similar into the console, or FTP access.
Incidentally re. comments about noise earlier  :

"Normal" mode :
Quote
.caps.config.image.targetNoise entry
.caps.config.image.targetNoise.enabled bool true
.caps.config.image.targetNoise.targetNoiseMk int32 135
"Service" mode :
Quote
.caps.config.image.targetNoise entry
.caps.config.image.targetNoise.enabled bool false
.caps.config.image.targetNoise.targetNoiseMk int32 0


 

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 21, 2013, 07:28:13 am
Editing that conf.cfg file doesn't seem to do anything...  :(

I wonder if this has anything to do with it... from /system/combtabs.d/combtab.appkit:

Code: [Select]
# combtab file for Astra
# This file should be present as different filenames in
# appkit, prodkit and OS project directory
TYPE combtab
#unique file identifier
DATE 2013-08-14
# Newest date for any combtab file identifies file to use.
# We cannot rely on file date because that might change when transfering files
KITS osimgkit, appkit, prodkit
# KITS line identifies resource branch for columns used in file. comma separated.
SHORT os, appkit, prodkit
# SHORT line identifies kits in the concatenated fullver resource. comma separated.
COMBINATIONS
# this line identifies that table starts.
# table lines comma separated as KITS above
# KITS osimgkit, appkit, prodkit
0.1.1, 1.0.1, 0.1.0, 0.1.0.1
0.2.2, 1.0.3, 0.2.0, 0.1.0.2
0.3.3, 1.0.5, 0.3.0, 0.1.0.3
0.4.3, 1.0.7, 0.3.0, 0.1.0.3
0.5.3, 1.0.7, 0.4.0, 0.1.0.3
0.5.4, 1.0.7, 0.4.0, 0.1.0.4
0.6.5, 1.0.9, 0.5.0, 0.1.0.5
0.7.6, 1.0.11, 0.6.0, 0.1.0.6
0.8.7,  1.0.11, 0.6.1,  0.6.1.7
0.9.7,  1.0.11, 0.6.2,  0.6.1.7
0.10.8,  1.0.11, 0.6.3,  0.6.1.8
0.11.8,  1.0.13, 0.6.3,  0.6.1.8
0.12.8,  1.0.13, 0.6.4,  0.6.1.8
0.13.8,  1.0.13, 0.6.5,  0.6.1.8
0.13.9,  1.0.13, 0.6.5,  0.6.1.9
0.14.9,  1.0.15, 0.6.5,  0.6.1.9
0.15.9,  1.0.15, 0.6.6,  0.6.1.9
0.15.10,  1.0.15, 0.6.6, 0.6.1.10
0.16.10,  1.0.17, 0.6.6, 0.6.1.10
0.17.10,  1.0.17, 0.6.7, 0.6.1.10
0.17.11,  1.0.17, 0.6.7, 0.6.1.11
0.18.11,  1.0.19, 0.6.7, 0.6.1.11
0.19.11,  1.0.19, 0.6.8, 0.6.1.11
0.19.12,  1.0.19, 0.6.8, 0.6.1.12
0.20.12,  1.0.21, 0.6.8, 0.6.1.12
0.21.12,  1.0.21, 0.6.9, 0.6.1.12
0.21.13,  1.0.21, 0.6.9, 0.6.1.13
0.22.13,  1.0.21, 0.6.10, 0.6.1.13
0.23.13,  1.0.23, 0.6.10, 0.6.1.13
1.0.1, 16.0.0, 1.0.0, 1.0.0.1
1.1.1, 16.0.2, 1.0.0, 1.0.0.1
I saw those - I think those numbers may be a reference to numbers in the eeprom.
BTW there is an I2C command in the console that appear to allow eeprom fiddling

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Stonent on October 21, 2013, 07:35:51 am
I just remembered something about WinCE not being able to access a volume when it was mounted via USB.
Once USB unplugged, you get another folder in the root directory - FlashIFS, so you can copy stuff on & off the device via this..!
http://youtu.be/sN3WK3IpH6E (http://youtu.be/sN3WK3IpH6E)

 :-+
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 21, 2013, 07:42:24 am
I think this means the hidden menu comes after any item in the camera settings menu. Either a magic key in the menu, or a key combination at startup (probably hard start, not out of standby)
Quote

<ui_model type="CameraInfoSettingsModel" name="cameraInfoSettingsModel">
    <ui_model_item type="SettingItem" ID="MODEL" label="ID_SETUP_MODEL" value="*" nextModel="hiddenServiceSettingsModel"/>
    <ui_model_item type="SettingItem" ID="SERIAL" label="ID_SETUP_SERIAL" value="*" nextModel="hiddenServiceSettingsModel"/>
    <ui_model_item type="SettingItem" ID="PART" label="ID_SETUP_PART" value="*" nextModel="hiddenServiceSettingsModel"/>
    <ui_model_item type="SettingItem" ID="SOFTWARE" label="ID_SETUP_SOFTWARE" value="*" nextModel="hiddenServiceSettingsModel"/>
  </ui_model>

If someone has an E4 and some time on their hands, it would be worth trying some random key combinations at powerup, then going into the camera info screen & seeing if you can get deeper....
I can't immediately find any obvious keys in this menu with a normal startup
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 21, 2013, 08:00:44 am
Mike,

My email provider keeps copies of my email on line for remote acess. Any chance your 'lost' i7 email still resides on your on-line  email arechive ? It might make your life a little easier.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 21, 2013, 08:21:23 am
Oh Mike.....you LOST the hack email   :palm:

Or did you hear the distinctive thump-thump-thump of the black helicopters rotors overhead ?  :scared:

If you ask GCHQ or the NSA nicely, they may provide you with their copy of the email  :-DD
Yep - hard disk on that laptop was failing around the time I got it - have tried to recover but no joy so far - may still be in there somewhere..

However.....
If you download the Ex firmware from Flir, and rename the .fif file to .cab  Many very interesting things appear.... Will take some time to examine....

What, you don't have your emails backed up or hosted online?  :palm:
Mostly yes, but  it was on a laptop I use in the house for casual email & web access & must have accidentally deleted the message from server before downloading on main PC. I didn't pay too much attention at the time as it seemed rather specific to the i7 - was only a few days later I realised it could be more significant.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on October 21, 2013, 08:40:07 am
Well, just in case you lose your posts in here and Dave's backups don't work ... not to worry, I'm mirroring this thread. And that does get backed up. :P

OT: was the big fat error when you edited the conf file? You could try editing it and then restoring the datestamp to the original date. Just in case they do something with the datestamp. Did you grab a serial dump during changed conf? I noticed a kind of expect count check in there for message counts. At start it said something along the lines of "expecting N messages" and then near the end it confirmed having received precisely N of those messages.

Also, does anyone have any direct links to E4 and E8 firmware downloads?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 21, 2013, 08:44:17 am
OT: was the big fat error when you edited the conf file?
No - I was messing around running random executables.
Quote
Did you grab a serial dump during changed conf?
Doesn't look obviously different - didn't look in fine detail - no error messages or anything, either with an edited file (=possible  bad crc) or swapping the service one in..
Quote
Also, does anyone have any direct links to E4 and E8 firmware downloads?
Ex is on the Flir site (need to register) - has a silly javascript link so can't link direct.
 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 21, 2013, 09:44:53 am
Some possibly interesting snippets in this file
http://www.imc-store.com.au/v/vspfiles/assets/images/flir%20a310%20technical%20notes.pdf (http://www.imc-store.com.au/v/vspfiles/assets/images/flir%20a310%20technical%20notes.pdf)
For a different model, but recent, and the web  interface matches some things found in the web folder of the Ex FW update file

Also possibly interesting stuff in the file linked in the above doc  - documents some of the WinCE  executables
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 21, 2013, 10:33:13 am
Here are the pinouts I've determined so far on the hidden bottom connector of the i7, for those interested. Is such a connector present on the E-series?
No -the connector is an internal FFC con.
You may find a second UART - on bootup it only throws out a few chars.
Also worth a good look through the FW update file, if available.

The PDF linked from the PDF I found above is very interesting.
All the settings are in "resources" a la Windows registry. These appear related to the various conf files, but not clear in which direction - it may be the files are derived from the resource settings or vice versa.
Look at the resource related commands in that second PDF. Beware rls -r recursive option - it spits out a LOT of data!
Unfortunately rset doesn't appear to work on image size, but have been able to set user settings using it.


Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on October 21, 2013, 10:47:45 am
Unfortunately rset doesn't appear to work on image size, but have been able to set user settings using it.
I also just went over the telnet commands, and was about to suggest rset. ;) . Too bad that is a nogo.

For future reference I grabbed all the firmware I could find for various models. Always handy to compare the .fif contents.

For those interested, you can grab it here (ex_pn639_v1.18.7 is for Ex series):
http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_ix_v4.3.2_update_pack.zip (http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_ix_v4.3.2_update_pack.zip)
http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_ixx_bxx_v2.19.1_update_pack.zip (http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_ixx_bxx_v2.19.1_update_pack.zip)
http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_ex_pn639_v1.18.7_update_pack.zip (http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_ex_pn639_v1.18.7_update_pack.zip)
http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_exx_pn490_v2.23.14_update_pack.zip (http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_exx_pn490_v2.23.14_update_pack.zip)
http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_exx_pn645_pn646_v3.8.5_update_pack.zip (http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_exx_pn645_pn646_v3.8.5_update_pack.zip)
http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_kxx_v1.19.9_update_pack.zip (http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_kxx_v1.19.9_update_pack.zip)
http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_t420-t440_v1.31.18_update_pack.zip (http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_t420-t440_v1.31.18_update_pack.zip)
http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_t6xx_v2.34.17_update_pack.zip (http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_t6xx_v2.34.17_update_pack.zip)
http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_gf3xx_v2.15.10_update_pack.zip (http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_gf3xx_v2.15.10_update_pack.zip)
http://support.flir.com/SwDownload/Assets/ATS/CameraFirmware/UpdateG33.zip (http://support.flir.com/SwDownload/Assets/ATS/CameraFirmware/UpdateG33.zip)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: bean_dip on October 21, 2013, 11:21:36 am
So, I was digging through more of the update.  Saw this...not sure if it refers to just image files or all of them, but it has a switch for forcing a file to load with a broken CRC...

Code: [Select]
usage: ftest [-q] [-n nr] [-e] [-x] [-i imageid] [-g groupid] [-s siteid]           
             [-l 0|1] [-t <tag>:<subtag>:<rev>:<file>] [-j <file>] [-d <tag>]           
             [-m] [-f] [-c <file>] [-r <x>:<y>:[e:]<file>] [-a <file>]           
             [-v <file>] [-b <file>] <image1> [image2] ...

  -q   quiet mode, only print error messages (on stderr)                                                                                                                                                                                                                         
  -n   read file <nr> in seq file, or \"iter\" to iterate whole file                                                                                                                                                                                                             
  -e   extract parts to file                                                                                                                                                                                                                                                     
  -x   extract each image in a sequence                                                                                                                                                                                                                                           
  -i   replace EXIF image ID with <imageid>, \"rand\" creates new                                                                                                                                                                                                                 
  -g   replace EXIF group ID with <groupid>, \"rand\" creates new                                                                                                                                                                                                                 
  -s   replace EXIF site ID with <siteid>, \"rand\" creates new                                                                                                                                                                                                                   
  -l   replace stitchLast with 0 or 1                                                                                                                                                                                                                                             
  -t   replace/add <tag> with data from <file> at revision <rev>                                                                                                                                                                                                                 
  -j   replace JPEG pixels with data from <file>                                                                                                                                                                                                                                 
  -d   delete <tag> from file                                                                                                                                                                                                                                                     
  -m   force map stats calc on image                                                                                                                                                                                                                                             
  -f   force loading by ignoring broken CRCs                                                                                                                                                                                                                                     
  -c   create color JPEG <file> from FFF data                                                                                                                                                                                                                                     
  -r   rescale to size <x>x<y> in <file> (add :e: for exact rescale)                                                                                                                                                                                                             
  -a   resave using original format to <file>                                                                                                                                                                                                                                     
  -v   save IR pixels as temp values as csv data in <file>                                                                                                                                                                                                                       
  -b   save image1, image2,... to seq <file> (.csq = compressed) 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 21, 2013, 11:30:58 am
Here are the pinouts I've determined so far on the hidden bottom connector of the i7, for those interested. Is such a connector present on the E-series?
BTW I'm pretty sure the i7 hack was using rset - image resolution, noise turned off, so if you can find a console UART or USB networking mode you may be in.
The hidden menu was 2 keys, one of which was one of the arrows, pressed after powerup.

As the front keypad acts like a keyboard ( You can fake buttons with bt.exe and enter/arrows navigate WinCe menus clears menus ), it may be a case of hitting keys at a certain time rather than hplding down from powerup.


rset does have an optional password so could be that making it fail.

Still unsure of the relationship between resources and the files.
 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on October 21, 2013, 11:31:09 am
Looking at facet_Z3.rcc would seem to suggest they are using Qt for their gui. Which is a good thing, as Qt doesn't suck. :P And it would also seem to suggest that at least that part was made in Sweden.

As for crc ... I noticed in camera.cmd it does this:
Code: [Select]
Check if crc have changed
kitcrc -c \FlashBFS\system\kits.d\appkit.rev
[*FAIL*][$GOTO failed2]
kitcrc -c \FlashBFS\system\kits.d\prodkit.rev
[*FAIL*][$GOTO failed2]

So you might be able to use kitcrc to adjust things to your liking. At any rate, camera.cmd is full of inspiration. ;)

Duh. blind. of course they use Qt.
Code: [Select]
./FlashBFS/system/QtDeclarative4.dll
./FlashBFS/system/QtCore4.dll
./FlashBFS/system/QtGui4.dll
./FlashBFS/system/QtNetwork4.dll
./FlashBFS/system/QtScript4.dll
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: bean_dip on October 21, 2013, 11:58:44 am
rset does have an optional password so could be that making it fail.

appcore.exe has a string Reference to "Lock, Unlock: 1235"...possibly related?

Let me know if I'm just clogging up the thread with useless junk...
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nowlan on October 21, 2013, 04:04:08 pm
From http://www.termsys.demon.co.uk/vtansi.htm (http://www.termsys.demon.co.uk/vtansi.htm)
ANSI/VT100 Terminal Control Escape Sequences
Query Cursor Position   <ESC>[6n

    Requests a Report Cursor Position response from the device.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 21, 2013, 08:03:29 pm
Here are the pinouts I've determined so far on the hidden bottom connector of the i7, for those interested. Is such a connector present on the E-series?
BTW I'm pretty sure the i7 hack was using rset - image resolution, noise turned off, so if you can find a console UART or USB networking mode you may be in.
The hidden menu was 2 keys, one of which was one of the arrows, pressed after powerup.

As the front keypad acts like a keyboard ( You can fake buttons with bt.exe and enter/arrows navigate WinCe menus clears menus ), it may be a case of hitting keys at a certain time rather than hplding down from powerup.


rset does have an optional password so could be that making it fail.

Still unsure of the relationship between resources and the files.

Found another TX port, which spits out " \> [6n" consistently on hard boot. Can't get any of the other ports to respond, though.
That looks like the console port - run a terminal program and send carriage returns to pins to find RXD until you see that prompt repeating.
The E4 gives a short version string at boot so may be slightly different :
Quote
FLIR Command Line Interpreter
Version 0.4.3 running on WinCE 6.0

\>

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 22, 2013, 09:37:47 am
Doesn't look like those .cfg files do much - it will start with the file not present - suspect they are debug output etc.
Looking at what  & when it reads from eeprom. Looks like most records have a 2 byte check at the end - anyone good at CRC-spotting? CRC in bold.
Quite a few sections get read multiple times - I've omitted duplicates
AEW is eeprom address
D0W is realtime clock

 Following read at power-up only
Quote
Time   Restart   Address   Data
-388.0us      AEW   80
-40.78us   X   AFR   0B 91 39 00 00 00 00 00 00 00 00 00 00 00 00
1.860s      AEW   40
1.860s   X   AFR   54 31 39 38 32 38 33 00 00 00 31 39 39 36 37 37 33 30 00 00 31 30 00 00 00 00 00 00 00 00 F7
1.900s      D0W   0
1.901s   X   D1R   27 54 23 01 21 10 13  ; RTC
1.930s      D0W   0
1.931s   X   D1R   27 54 23 01 21 10 13
2.246s      AEW   0
2.246s   X   AFR   46 4C 49 52 20 45 34 00 00 00 00 00 00 00 00 00 00 00 00 00 36 33 39 30 31 2D 30 31 30 31 00 00 00 00 00 00 36 33 39 30 33 37 37 31 00 00 32 30 31 33 2D 31 30 2D 30 32 00 00 30 31 00 00 DC C7
4.419s      AEW   C0
4.419s   X   AFR    50 00 3C 00 00 06 00 00 00 00 00 00 00 00 8C 06
50 00 = 80 decimal, 3C 00 = 60 decimal - VERY INTERESTING!!! also 60Hz/6=10 - could the 06 be framerate?

Following read at app restart from console, and after above at powerup
Quote
1.233s      AEW   A0
1.234s   X   AFR   54 31 39 38 33 30 34 00 00 00 36 33 38 30 34 35 38 35 00 00 30 31 00 00 FF FF FF FF FF FF FB 98
1.251s      AEW   0
1.252s   X   AFR   46
1.254s      AEW   D0
1.255s   X   AFR   FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF
1.482s      AEW   C0
1.483s   X   AFR   50 00 3C 00 00 06 00 00 00 00 00 00 00 00 8C 06

3.661s      AEW   0
3.662s   X   AFR   46 4C 49 52 20 45 34 00 00 00 00 00 00 00 00 00 00 00 00 00 36 33 39 30 31 2D 30 31 30 31 00 00 00 00 00 00 36 33 39 30 33 37 37 31 00 00 32 30 31 33 2D 31 30 2D 30 32 00 00 30 31 00 00 DC C7
3.673s      AEW   0
3.674s   X   AFR   46
3.675s      AEW   0
3.676s   X   AFR   46 4C 49 52 20 45 34 00 00 00 00 00 00 00 00 00 00 00 00 00 36 33 39 30 31 2D 30 31 30 31 00 00 00 00 00 00 36 33 39 30 33 37 37 31 00 00 32 30 31 33 2D 31 30 2D 30 32 00 00 30 31 00 00 DC C7




19.86s      AEW   A0
19.86s   X   AFR   54 31 39 38 33 30 34 00 00 00 36 33 38 30 34 35 38 35 00 00 30 31 00 00 FF FF FF FF FF FF FB 98


29.66s      AEW   40
29.66s   X   AFR   54 31 39 38 32 38 33 00 00 00 31 39 39 36 37 37 33 30 00 00 31 30 00 00 00 00 00 00 00 00 F7 A8


hang on a minute.... I think I spotted the check method 
50 00 3C 00 00 06 00 00 00 00 00 00 00 00 8C 06

50 00
3c 00
00 06
00 00
....
00 00
Check is 8C 06
It's a simple 16 bit checksum FFS!!!!

Let's check with another  one to see how the carry works..
54 31
39 38
32 38
33 00
00 00
31 39
39 36
37 37
33 30
00 00
31 30
00 00
00 00
00 00
00 00
F7 A8

Add them up  (Lsb:Msb) - 1A8F7 - Yesss!



Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 22, 2013, 09:51:07 am
Hmmm - changed eeprom and it changed it back....!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: neggles on October 22, 2013, 11:02:03 am
Hmmm - changed eeprom and it changed it back....!

That's... odd. It must be cross-checking with something on the flash so you can't just change one place.

But if it's just going to overwrite the eeprom, why even have the eeprom?!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 22, 2013, 11:50:57 am
That looks like the console port - run a terminal program and send carriage returns to pins to find RXD until you see that prompt repeating.
The E4 gives a short version string at boot so may be slightly different :

No carriage return, but sending anything to the port above the TX2 port (likely RXD) makes it appear on the serial monitor -- that doesn't happen with any of the other ports. Question marks don't do anything -- perhaps the [6n is asking the device what position the keyboard is in, so that it can trigger CLI mode?

Had to enable NL & CR in terminal!  :palm:

For comparison, remember this is from i7, not E4!

Code: [Select]
\>?

?         alias     attrib    beep      bootdeletecall      cd        chdir
choice    cls       copy      date      del       delete    delay     dir
dirs      echo      echos     echoerr   echoserr  erase     exit      for
free      goto      help      history   if        irqlog    memory    md
mkdir     move      path      pause     popd      prompt    pushd     rd
rem       ren       rename    restart   replace   rmdir     rcd       rpwd
rls       rset      rclone    rcreate   rdelete   rdump     rfind     rpatch
rreload   screen    set       shift     start     time      timer     type
ver       

\>help

List of all available commands (+ description)

  command /?     For more information on a specific command

?        List all available commands without description).
ALIAS    Sets, removes or shows aliases.
ATTRIB   Displays or changes file attributes.
BEEP     Beep the speaker.
CALL     Calls one batch program from another.
CD       Displays the name of or changes the current directory.
CHOICE   Waits for the user to choose one of a set of choices.
CLS      Clears the screen.
CMD      Starts a new instance of the FLIR command line interpreter.
COPY     Copies one or more files to another location.
DATE     Displays or sets the date.
DELETE   Deletes one or more files.
DIR      Displays a list of files and subdirectories in a directory.
ECHO     Displays messages, or turns command echoing on or off.
ERASE    Deletes one or more files.
EXIT     Quits the CMD.EXE program (command interpreter).
FOR      Runs a specified command for each file in a set of files.
FREE     (free) disc space.
GOTO     Directs the FLIR command line interpreter to a labeled line in
         a batch program.
HELP     Provides Help information for FLIR commands.
HISTORY  List all commands which has been used
IF       Performs conditional processing in batch programs.
MD       Creates a directory.
MKDIR    Creates a directory.
MOVE     Moves one or more files from one directory to another
         directory.
PATH     Displays or sets a search path for executable files.
PAUSE    Suspends processing of a batch file and displays a message.
POPD     Restores the previous value of the current directory saved by
         PUSHD.
PROMPT   Changes the command prompt.
PUSHD    Saves the current directory then changes it.
RD       Removes a directory.
REM      Records comments (remarks) in batch files.
REN      Renames a file or files.
RENAME   Renames a file or files.
REPLACE  Replaces files.
RMDIR    Removes a directory.
SCREEN   Move cursor and optionally print text.
SET      Displays, sets, or removes FLIR command line interpreter environment variables.
SHIFT    Shifts the position of replaceable parameters in batch files.
START    Starts a separate window to run a specified program or command.
         Executes command.
TIME     Displays or sets the system time.
TIMER    Allow the use of ten stopwatches.
TYPE     Displays the contents of a text file.
VER      Displays the FLIR command line interpreter and Windows CE version.


Time to explore resources with rls and rcd...


Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 22, 2013, 11:53:34 am
fvd.exe and fvd.dll look interesting - I think this is the first thing run at boot time - contains the downsampling message as well as references to eeprom checksum error.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Psi on October 22, 2013, 12:15:30 pm
Hmmm - changed eeprom and it changed it back....!

Here's hoping it didn't just increment a tamper counter.  Strike 1  hehe.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 22, 2013, 08:04:21 pm
Code: [Select]
\>rls system

MACaddr         "censored"
eeprom                           
focus                           
fvd                             
powerButton                     
restart                    false
restartDelay                   1
sync                          ""
tempsens                         
tempsensActive              true
tempsensError              "0 0"
tempsensValid               true
time                             
usbmode                    "MSD"
webpasswd                "IRCAM"

\>

Still trying to figure out how to use rls/rcd...
The resource stuff like a tree. rcd is a convenient way of sitting at a deep level so you don't need to specify the full path.
e.g. to see teh time value you can do
rls system.time
or rcd system
rls time

rls [path] -r will show the whole  subtree
-l shows more info including attributes

rset allows values to be changed once you've used rls to find the key and format

rdump allows a tree to be dumped to a file

most of these utils have some inbuilt help using /?

Also have a look in the flashBFS\system dir for other executables.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: amyk on October 22, 2013, 09:07:51 pm
Hmmm - changed eeprom and it changed it back....!

That's... odd. It must be cross-checking with something on the flash so you can't just change one place.

But if it's just going to overwrite the eeprom, why even have the eeprom?!
Another possibility is that there is data stored in the sensor itself (possibly in OTP), as is often done for regular camera chips.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on October 23, 2013, 12:29:42 am
I accidentely stumbled upon the attached file.
It might be helpful in some way (commands/parameters), it might not.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 23, 2013, 01:54:32 am
I accidentely stumbled upon the attached file.
It might be helpful in some way (commands/parameters), it might not.
Yes - that's the one linked from the PDF I mentioned earlier - some parts are out of date but some useful snippets in there
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tom66 on October 23, 2013, 02:26:02 am
wonder how difficult it would be to decompile the *.exe and figure out what's happening when the downsampling messages are printed?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 23, 2013, 03:18:04 am
wonder how difficult it would be to decompile the *.exe and figure out what's happening when the downsampling messages are printed?
fvd.exe and fvd.dll aren't very big, so should be fairly doable, given a decent cross-referencing diassember
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tom66 on October 23, 2013, 05:33:24 am
It is an ARM processor though so availability of those for EXE files may be scarce, probably IDA Pro will do it but I don't know.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: AF6LJ on October 23, 2013, 09:09:13 am
Good Video, I enjoyed watching it.  :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: bean_dip on October 23, 2013, 10:57:37 am
I was looking at them with the demo of IDA Pro. It does have the option for ARM but you can't access it in the demo...it would do it as a generic binary and I got what looked like assembly, but I'm not good enough to make heads or tails of it. I was just digging out the strings from the exe's in the update and posting them earlier since I still don't have my camera.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: bean_dip on October 24, 2013, 01:16:49 pm
Okay,

I'm not good enough to make heads or tails of a lot of what I'm seeing here.  I don't have a full version of IDA Pro so I can't disassemble for ARM, but I can as a generic binary.  I'm still learning but maybe this will mean something to someone else.  Attached are the results of IDA's disassembly and code generation.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nowlan on October 24, 2013, 05:34:32 pm
The free/demo version of ida pro only do windows 32 x86 code.
At best you can read the strings in the binary.

Im sure some others around here have the pro version, required for rigol hacks.

Dont know any arm decompilers off the top of my head.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Ed.Kloonk on October 24, 2013, 07:17:02 pm
Sorry for being late to the party. Wanted to say thanks Mike for this vid and the review. And the x-ray machine vid.

I watch them here and there after downloading them (slowly) and forget to say ta!

 :-+
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nitroxide on October 24, 2013, 07:30:37 pm
I've been silently following the E4 related threads for some time. Must say, juicy information :)

I don't have an E4 (yet... -  that may change :) ) but I've tried to put together some bits of information that I've found around in this thread. IMHO the simple way to go is using the Web Interface (you can access most, if not all, camera settings from there - including a special Service Menu) - all menus conveniently listed in FlashBFS/system/web/ and sub-folders

..and if you send a <space> to the UART during boot....
SETTINGS:
0) IP address: 0.0.0.0
1) Subnet Mask: 0.0.0.0
2) Boot delay: 1 seconds
3) DHCP: Enabled
4) Reset to factory default configuration
5) Autoboot: NK from NOR
6) MAC address: 00:40:7F:0B:91:39
7) Host connection: (USB MSD)
Option 7 may be intersting - options are USB BSD, ETHERNET and USB RNDIS, which provides virtual ethernet over USB - fairly sure the latter is what enabled the i7 hack


As Mike said, if 7) is changed to USB RNDIS (and may be that IP address and subnet mask also need to be set manually and DHCP disabled - if the PC doesn't assign them automatically over USB), the web service can be accessed.

Now, as for the A310 FLIR (the attached PDF with Technical Notes), it must be password protected, but I see that the password is already known: webpasswd "IRCAM"

Therefore (stating the obvious) the login info should be:
Username: flir
Password: IRCAM

Could someone try this?

P.S. With the risk of being Cpt. Obvious, I just want to be involved in this and help if I can do so ;D
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 24, 2013, 08:11:55 pm
Okay,

I'm not good enough to make heads or tails of a lot of what I'm seeing here.  I don't have a full version of IDA Pro so I can't disassemble for ARM, but I can as a generic binary.  I'm still learning but maybe this will mean something to someone else.  Attached are the results of IDA's disassembly and code generation.

Not really useful unfortunately - it really needs a disassembler that knows the instruction set, even if it doesn't understand the .EXE structure
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 24, 2013, 08:17:57 pm
I've been silently following the E4 related threads for some time. Must say, juicy information :)

I don't have an E4 (yet... -  that may change :) ) but I've tried to put together some bits of information that I've found around in this thread. IMHO the simple way to go is using the Web Interface (you can access most, if not all, camera settings from there - including a special Service Menu) - all menus conveniently listed in FlashBFS/system/web/ and sub-folders

..and if you send a <space> to the UART during boot....
SETTINGS:
0) IP address: 0.0.0.0
1) Subnet Mask: 0.0.0.0
2) Boot delay: 1 seconds
3) DHCP: Enabled
4) Reset to factory default configuration
5) Autoboot: NK from NOR
6) MAC address: 00:40:7F:0B:91:39
7) Host connection: (USB MSD)
Option 7 may be intersting - options are USB BSD, ETHERNET and USB RNDIS, which provides virtual ethernet over USB - fairly sure the latter is what enabled the i7 hack


As Mike said, if 7) is changed to USB RNDIS (and may be that IP address and subnet mask also need to be set manually and DHCP disabled - if the PC doesn't assign them automatically over USB), the web service can be accessed.

Now, as for the A310 FLIR (the attached PDF with Technical Notes), it must be password protected, but I see that the password is already known: webpasswd "IRCAM"

Therefore (stating the obvious) the login info should be:
Username: flir
Password: IRCAM

Could someone try this?

P.S. With the risk of being Cpt. Obvious, I just want to be involved in this and help if I can do so ;D

Is there something you need to do to get a PC (XP or Win7) to recognise and talk to a RNDIS device ? I tried setting this option but the PC didn't show anything other than the normal MSD and camera USB devices.

I am fairly convinced there is a secret menu that allows access to this setting without needing to access the serial port, probably a a magic key combination.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nitroxide on October 24, 2013, 08:30:22 pm
Yes, it appears there's a FLIR provided IP over USB driver. I'm digging up for that now.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 24, 2013, 08:38:58 pm
This looks useful http://carolos.za.net/software.html (http://carolos.za.net/software.html)
Quote
   

ABOUT ChARMeD:
ChARMeD is a Windows Mobile / Pocket PC /  Win CE (for ARM CPUs) Disassembler and Assembler

The name ChARMeD stands for:
  Carolo's Hexadecimal ARM Editor and Disassembler

FEATURES:

·    Disassemble a Windows CE Executable for ARM CPUs.
·    Assemble instructions in ARM Assembler.
·    Upload modified file to Windows CE Device.

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 24, 2013, 09:09:57 pm
Rats! ChARMed doesn't seem to understand this flavour of ARM... Anyone have access to a full version of IDA PRO?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: BravoV on October 24, 2013, 09:20:30 pm
I am fairly convinced there is a secret menu that allows access to this setting without needing to access the serial port, probably a a magic key combination.

Not an expert, thinking of that since now there is a possibly working dis-assembler + with that believe, maybe it might be a time saver to focus only at the IO related routines/code section than handles the keys and it's keys lookup table ?  :-//
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: equinoxe on October 24, 2013, 09:42:09 pm
Rats! ChARMed doesn't seem to understand this flavour of ARM... Anyone have access to a full version of IDA PRO?

Jups, I have an old IDA Pro 6.2.1 running on my Mac and I found an even older 6.1.0 on my windows laptop.
Not that I am anywhere good at disassembling ARM code, but drop me a PM with a link to these files and I'll give it a shot.

Regards,

EqX
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 24, 2013, 10:21:56 pm
 I think I've now worked out all the I2C devices :
0x92 Temperature sensor
0xD0 Realtime clock
0xAE EEPROM
0xAA BQ27510 battery manager

Only just figured out the last one as the device marking was only a partial number. This has the capability of hiding data so not impossible that it might be involved in more than battery management  - not looked at what it's reading from it & when yet.

The visible camera will also have an I2C interface but it's not directly connected to the main I2C bus - may be via a level shifter as these modules are usually on 1.8v levels, or on a different bus.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: amyk on October 24, 2013, 10:39:50 pm
Rats! ChARMed doesn't seem to understand this flavour of ARM... Anyone have access to a full version of IDA PRO?
It's a mix of Thumb (http://en.wikipedia.org/wiki/ARM_architecture#Thumb) mode and regular. ChARMed only supports regular ARM.

Anyway I took a look with an old version of IDA (not all ARM instructions supported so there's valid code mixed with bits of rubbish) and it looks like it might be reading resolution etc. from the sensor itself over I2C...
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nitroxide on October 24, 2013, 10:45:36 pm
I'm sorry it took some time (I still have to work on other stuff meantime). I've found the drivers! I can clearly confirm these contain the FLIR RNDIS driver (I've studied the drivers MSI content and found among other drivers the RNDIS driver).

Mike, could you please install the Device Drivers, do the USB RNDIS setting and see if you get the device discovered in Windows? You find the drivers at FLIR support page on Download Software tab (Product: PC Software (Thermography) -> FLIR Device Drivers).
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 24, 2013, 11:00:01 pm
Anyway I took a look with an old version of IDA (not all ARM instructions supported so there's valid code mixed with bits of rubbish) and it looks like it might be reading resolution etc. from the sensor itself over I2C...
That's the next thing on my list to look at when I get time - I saw some I2C traffic I couldn't figure out which turned out to be the power manager, but there is almost certainly another I2C bus used by the visible cam, which I'll find and probe to see if there are any other devices on it, and if it's connected to the sensor connector.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nitroxide on October 25, 2013, 12:43:41 am
From the Ex firmware, using the resources in the web folder and some fiddling around I was able to make the index.asp run on PC  just to have an overview of the menu items available in the web interface. See attached image.

I'm pretty sure the EEPROM->Edit Camera Information menu allows changing the 'Camera part number' to the one of E8 for instance. There seems to be a locking mechanism in place for EEPROM editing (protected by password) - I don't know yet how it's implemented but it may have to do with Mike's attempt to directly modify the EEPROM content: Mike: Hmmm - changed eeprom and it changed it back....! See also attached a picture of the EEPROM->Edit Camera Information.

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 01:00:42 am
I'm pretty sure the EEPROM->Edit Camera Information menu allows changing the 'Camera part number' to the one of E8 for instance. There seems to be a locking mechanism in place for EEPROM editing (protected by password) - I don't know yet how it's implemented but it may have to do with Mike's attempt to directly modify the EEPROM content: Mike: Hmmm - changed eeprom and it changed it back....! See also attached a picture of the EEPROM->Edit Camera Information.
My guess is the lock/unlock is a simple mechanism to prevent accidental changes - either a value in EEPROM or a password in the firmware.

Had a very quick scan trhough a disassembly of FVP.DLL, and there is some code that does a 16 bit checksum of an area of memory under certain circumstances puts 80 and 60 in specific locations, so probably some default behaviour if anything isn't correct. Need to look in more detail at what gets read from eeprom when..
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nitroxide on October 25, 2013, 01:17:21 am
Thanks for the insight on that! I'll try to do some disassemblying too, maybe I can find anything useful.

What's your opinion on the web interface -> EEPROM -> Edit Camera Information -> Camera part number, edit to E8 part number? Do you think that would work? While some dissasebly work could shed a light on how that info is used (I'll try to find out), what's your guess?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 01:55:19 am
I have tried changing E4 to E8 in the eeprom with no effect.

I have found code (100033AC for those following along) that reads 16 bytes from the EE, checksums it and if sums OK, stores the EEPROM values somewhere , and if not stores 80 and 60 in the same locations. Still looking at other eeprom related code. I think the 6 near the resoltion data is also significant - seems to correlate with the "downsampling setting" vales displayed at boot.

I only had a very quick try at changing the ee so could be I got the sum wrong.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mamalala on October 25, 2013, 02:00:14 am
I have tried changing E4 to E8 in the eeprom with no effect.

I have found code (100033AC for those following along) that reads 16 bytes from the EE, checksums it and if sums OK, stores the EEPROM values somewhere , and if not stores 80 and 60 in the same locations. Still looking at other eeprom related code. I think the 6 near the resoltion data is also significant - seems to correlate with the "downsampling setting" vales displayed at boot.

I only had a very quick try at changing the ee so could be I got the sum wrong.

Assuming that you made a backup of the EEProm: Did you try to erase the thing? Just speculating here, but maybe the contents will be built from the config files you had fiddled with earlier.

Greetings,

Chris
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on October 25, 2013, 02:08:35 am
I will be on vacation now for a week ..... hoping that you guys find a solution in the meantime. :-+
If not; I can offer to lend an E8 for a day or two and read out the eeprom for you, assuming that it will help.
I can of course readout even more from the E8, but will need some help. If there is no progress here when I return, I will write a PM to Mike then.
I keep my fingers crossed.

Peter
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 02:22:53 am
I will be on vacation now for a week ..... hoping that you guys find a solution in the meantime. :-+
If not; I can offer to lend an E8 for a day or two and read out the eeprom for you, assuming that it will help.
I can of course readout even more from the E8, but will need some help. If there is no progress here when I return, I will write a PM to Mike then.
I keep my fingers crossed.

Peter

Info from an E8 would certainly be very useful - it can all be read out with a serial connection after removing 2 screws, unless we can find the hidden menu and get the USB stuff happenning and get a console prompt over it..!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 03:30:57 am
Hmmm. found code that looks for the string "T198389" from I2C address 0XA0, and if found "SB0801 detector   found " else "ULIS detector found"

Don't have the bootup text to hand to see which the E4 returns

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 06:51:22 am
Interesting snittet...

FLIR::CObfuscatedStringResource::Obfuscate(class FLIR::CResourceValue const &, class FLIR::CResourceValue   &, enum    FLIR::CObfuscatedStringResource::OBFUSCATE_MODE_T)
.idata:0005B364   IMPORT


Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 07:54:53 am
Looking at the USB RNDIS stuff.
Installed FLIR drivers as mentioned earlier.
No joy changing the USB mode in the boot menu, but at the console,
usbfn RNDIS
appears to do the trick - the PC popped up a USB driver prompt, and "install automatically" made it happy.
This setting is volatile.
usbfn Mass_Storage_Class
switches back to a PC-accessable drive,  can't see a way to run both at the same time.

IP address was 192.168.0.2 ( not what I had set in boot menu), as shown by ipconfig at boot menu
Web browser pointed at 192.168.0.2 gives this screen.

Telnet takes you to the console, and appears to allow access to everything that the serial console does, e.g. the I2C command to fiddle with eeprom.  8)

There is an FTP client, but the flir/3vlig login doesn't work


Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nitroxide on October 25, 2013, 08:13:59 am
Heh, that's good news Mike! Now if we only knew what needs to be changed to make it an E8 :)

Meanwhile I've spent some time trying to find out how to get in the Hidden Service Settings menu (to be able to enable USB RNDIS without opening the camera). I think "facet_Z3.rcc" is the file to check for key-combination parsing. I'm still trying to find out a way to decode parts of it.

 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 08:24:59 am
Heh, that's good news Mike! Now if we only knew what needs to be changed to make it an E8 :)

Meanwhile I've spent some time trying to find out how to get in the Hidden Service Settings menu (to be able to enable USB RNDIS without opening the camera). I think "facet_Z3.rcc" is the file to check for key-combination parsing. I'm still trying to find out a way to decode parts of it.
Bear in mind it may also be a magic key combination during startup that enables the menu in the UI - this was the case with the i7 .
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nitroxide on October 25, 2013, 08:26:36 am
Another thing. It would be really interesting (at least for me if not for others also) what would happen if you enable the UVC mode for USB. Does this result in a USB video stream of thermographic video (basically like webcam)? 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nitroxide on October 25, 2013, 08:34:21 am
Heh, that's good news Mike! Now if we only knew what needs to be changed to make it an E8 :)

Meanwhile I've spent some time trying to find out how to get in the Hidden Service Settings menu (to be able to enable USB RNDIS without opening the camera). I think "facet_Z3.rcc" is the file to check for key-combination parsing. I'm still trying to find out a way to decode parts of it.
Bear in mind it may also be a magic key combination during startup that enables the menu in the UI - this was the case with the i7 .

I would say it has to be in this file as all QMLs (including SettingsPage.qml) and menu navigation are generated from this .rcc file.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 08:35:39 am
Correction : FTP login flir / 3vlig does work, but not on all FTP clients - Windows command line FTP works, FTPsurfer doesn't

BTW flir/IRCAM doesn't work on web interface
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 08:37:06 am
Another thing. It would be really interesting (at least for me if not for others also) what would happen if you enable the UVC mode for USB. Does this result in a USB video stream of thermographic video (basically like webcam)?
You can do that with the standard, unmodified product, as mentioned in the review.  Just plug in & it appears as a digital camera device & you can record video. Framerate is a bit messed up but it does work.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nitroxide on October 25, 2013, 08:38:37 am
Oops, my bad! I may have skipped parts of the review...  :-[
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 25, 2013, 09:20:56 am
Hey Mike,

Just to let you know that your tear down video and investigation is being watched closely by comapnies in the TIC industry. Three separate technical officers have mentioned it to me recently  ;)   You are causing a bit of a stir  :-+
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ixfd64 on October 25, 2013, 09:26:12 am
If you're going to void the warranty, you might as well go the whole nine yards. ;D
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 09:29:09 am
OK Useful-ish Hack stage 1 is achieved.

UART console : usbfn RNDIS

Plug USB into PC (having loaded Flir device drivers from http://flir.custhelp.com/app/account/fl_download_software, (http://flir.custhelp.com/app/account/fl_download_software,) PC softare (Thermography) -> device drivers)

Web login to service menu (192.168.0.2) with user flir, PW 3vlig

Enable service mode - reboots camera into service mode (takes about 45 secs)

Some E8 functions now available -Auto hotspot, Auto coldspot, more colour pallettes

Oh, and.....
320x240 resolution

Boot text in service mode
Quote
FVD_Init: Downsampling setting: 0x00
FVD_Init: re-read the hardware information x: 320, y: 240

On next  power-up boot :

Quote
APPLAUNCHER: Starting usb charge App
ProgressApp expecting 301 events
FVD_Init: Downsampling setting: 320 240
Timeprint (3518)
POST 20131025 00:08:42 -      appcore.exe: Application started
....
POST 20131025 00:08:44 -      appcore.exe: TSFpa: 303.000000 K
FVD_Init: Downsampling setting: 0x00
FVD_Init: re-read the hardware information x: 80, y: 60


Unfortunately sleep/restore doesn't seem to work to keep it in service mode as long as battery connected  :(
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 25, 2013, 09:33:19 am
RESPECT  :-+
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 09:33:31 am
Hey Mike,

Just to let you know that your tear down video and investigation is being watched closely by comapnies in the TIC industry. Three separate technical officers have mentioned it to me recently  ;)   You are causing a bit of a stir  :-+
I wouldn't expect any less  8)
Saves them paying for one of those expensive reports from people like Systemplus.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 25, 2013, 09:41:13 am
If you achieve your objective, I predict a very sharp increase in E4 sales ...... FLIR will have a major seller on their hands. I wonder how they will feel about that ?

I am aware that industry will continue to buy the full cost units due to calibration etc, but the E4 would become the cheapest 320x240 on the market and built by a top class manufacturer ! The Consumer TIC Holy Grail.

Very interesting times  :)

Oh and forget about the black helicopters.... it will be the white van snatch squad from FLIR that you need to worry about.  :-DD
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on October 25, 2013, 09:44:20 am
Well done!   :-+

So basically an old school IP-over-USB + use the telnet/web/whatever interface and you're in service mode? awesome!  ;D
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 09:45:39 am
One minor issue is in RNDIS mode you can't get USB access to the drive, but you can get at the files via FTP in net mode - an advantage of this is you can take pics and pull files with USB connected - in normal mode the filesystem can only be mounted by the PC or the camera at any time.

but you can do
usbfn Mass_Storage_Class
via telnet, which reverts it to mass storage ( and dumps the net connection, obviously)

If you only have Telnet, be careful with spelling as any misspelling will dump the RNDIS link but not start MSD



Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nitroxide on October 25, 2013, 09:52:18 am
That was quick. Good job Mike!  ;D

Have you tried the RNDIS_UVC_MSD mode instead of RNDIS?

On another topic, I've made some good progress on Hidden Service Menu investigation, but I'm too tired to finalize this. If someone wants to give it a try - disassemble facet_ui_qml.dll and search for "hidden" string.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: bean_dip on October 25, 2013, 09:53:28 am
Much respect Mike!

I'm still playing around with key combinations...nothing great yet, but while charging if you press "Left" and "Right" at the same time you get charge statistics under the charging icon.  But, this does verify the presence of hidden key sequences.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 09:53:52 am
The only thing stopping this being done without opening the unit is finding the magic way to get to teh hidden menu to enable RNDIS.

..and of course potentially the next FLIR firmware update....

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 10:03:45 am
That was quick. Good job Mike!  ;D

Have you tried the RNDIS_UVC_MSD mode instead of RNDIS?

On another topic, I've made some good progress on Hidden Service Menu investigation, but I'm too tired to finalize this. If someone wants to give it a try - disassemble facet_ui_qml.dll and search for "hidden" string.
doesn't seem to work - it won't let me copy or FTP off usbfn.exe to look for strings
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tom66 on October 25, 2013, 10:05:09 am
OK, the E4 is seriously tempting me...

(http://leanneellington.com/wp-content/uploads/2012/03/youre-awesome.jpg)

I expect a hackable E4 would not lead to a significant reduction in E8 sales, but would lead to a large increase in E4 sales to the hobbyist/budget market.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on October 25, 2013, 10:05:45 am
Deleted - Sorry, I wrote rubbish .....  its too late now: 1:10 am
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 10:12:09 am
http://flir.custhelp.com/app/account/fl_downloads (http://flir.custhelp.com/app/account/fl_downloads)

Software -> PC Software (Thermography) -> FLIR Device drivers -> X86 or x64 as appropriate

You do need to register.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nitroxide on October 25, 2013, 10:13:29 am
Direct link to drivers: http://cdn.cloud.flir.se/swdownload/assets/other/flir_device_drivers.exe (http://cdn.cloud.flir.se/swdownload/assets/other/flir_device_drivers.exe)
Both x86 and x64 seem to point to the same file - correct me if I'm wrong.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on October 25, 2013, 10:16:12 am
Quote
I expect a hackable E4 would not lead to a significant reduction in E8 sales, but would lead to a large increase in E4 sales to the hobbyist/budget market.

You bet! I already placed my order. Finally I can check my prototypes about hot spots and heat spreading. A resolution of 80x60 was nothing to write home about, but 320x240 for 1200 Euro (incl. VAT) is fair.... and as I side effect I can check my house for hidden problems.

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 10:28:29 am
Just tried a few permutations of sleep mode to see if test mode can be sustained longer term, but it seems to flake out - if plugged int USB it sticks at the battery logo when you wake, if not, it sort of wakes up then crashes.
I suspect cockup over conspiracy on this one....

Of course until we find the secret key or fully hack it, a little PIC/AVR on a flex plugged into the test connector to say "usbfn RNDIS" when it sees the command prompt would do the trick...!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 10:34:00 am
Little snippet from resources when in service mode
Quote
.caps.config: (3)
name            "app E4 1.0 + app prodconvconf_std 999.9KaKaOnly"
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 10:44:48 am
Update - although manually turning off from service mode crashes it, it seems like if you let the auto-power off time out, it wakes back up in service mode (with  RNDIS still running).
 
Incidentally I think the image resolution is being limited to some extent by the lens. Hard to tell if the temperature data is still accurate.
Question for any TIC experts - would a bigger lens affect the calibration? (looks like you probably could recal via service mode though)

oh and for the web experts - by looking through the .asp files etc. can you deduce anything about what it actually does when you hit the 'enable service mode' button? Even a snippet of text that could be looked for in executables might be interesting. I have seen references to something like "oneshotservicemode"
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ixfd64 on October 25, 2013, 11:05:34 am
I'm not sure if this helps, but I found these links to be quite interesting:

http://www.imc-store.com.au/v/vspfiles/assets/images/flir%20a310%20technical%20notes.pdf (http://www.imc-store.com.au/v/vspfiles/assets/images/flir%20a310%20technical%20notes.pdf)
http://support.flir.com/DocDownload/Assets/75/English/T559504$A.pdf (http://support.flir.com/DocDownload/Assets/75/English/T559504) (copy and paste the URL if it doesn't work)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 11:12:22 am
Your second hyperlink is broken -- copying the URL and pasting it in works, however.
I think that's the same doc I linked to previously
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on October 25, 2013, 12:14:18 pm
It looks like the forum software eats $$$. Oh wait, I think I see what's happening. Some clever php monkey needs to take a course on input handling. At any rate, if you put a [url] tag around it yourself it leaves it alone: linkie (http://support.flir.com/DocDownload/Assets/75/English/T559504$A.pdf)

Or you can change the $ to %24, and you can leave it our there without explicit tag: http://support.flir.com/DocDownload/Assets/75/English/T559504%24A.pdf (http://support.flir.com/DocDownload/Assets/75/English/T559504%24A.pdf)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: all_repair on October 25, 2013, 12:25:37 pm
Quote
I expect a hackable E4 would not lead to a significant reduction in E8 sales, but would lead to a large increase in E4 sales to the hobbyist/budget market.

You bet! I already placed my order. Finally I can check my prototypes about hot spots and heat spreading. A resolution of 80x60 was nothing to write home about, but 320x240 for 1200 Euro (incl. VAT) is fair.... and as I side effect I can check my house for hidden problems.

Yah, I have no need or hardly need a ThermoCam, but now I am going to get one to check for shorted cap, shorted rails, etc.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Psi on October 25, 2013, 01:49:33 pm
Is the webcam output 320x240 when in service mode and is the framerate higher as well? 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: amyk on October 25, 2013, 04:37:58 pm
From the fvd.dll, it appears not long after FVD_Init starts, and after calling function that reads downsampling setting from I2C (not sure if EEPROM or sensor) it tries to open
Code: [Select]
\Temp\__higres.cnfand if it can, it just closes and deletes the file without trying to read anything from it... and writes
Code: [Select]
FVD_Init: Oneshot high resolution modethen write something into memory and continues... so one thing to make this persistent might be to create that file on the device and mark it read-only. (This is assuming the filesystem of WinCE is similar enough to a standard Windows one to have attributes and such.)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: bean_dip on October 25, 2013, 07:07:51 pm
Can someone post a copy of this file for those of us not brave enough to open our cameras for the serial port?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 07:19:00 pm
Can someone post a copy of this file for those of us not brave enough to open our cameras for the serial port?
At the moment the only way in is via the serial port as it is the only known way to get a console prompt, to put the USB into RNDIS mode.
There does appear to be a hidden menu to enable RNDIS - until this is found you need to open it.
 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 07:45:16 pm
Someone has a sense of humour!
In service mode :
Quote
\temp>type __highres.cnf
HandsOff
\temp>
Also in temp is a config.cnf file - this may explain why modding the config files in flashfs didn't appear to do anything -  maybe it's only looking at files copied into \temp 

Left unit in auto-poweroff sleep overnight and seems to wake up OK.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 07:53:14 pm
Looks like a normal startup deletes everything in temp - actually I think temp is a RAM volume as it's above the flash-x-FS directories

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 08:05:17 pm
BTW updated connector pinout
Starting from end nearest to the unpopulated FFC connector

1 On/Off switch (to ground)
2 Power - Vbattery during run and charge - possibly via a FET switch as I didn't see continuity to bat terminal
3 Console TXD
4 Console RXD
5 Debug  TXD
6 Debug RXD
7 0V
8 /Reset
9  Output
10 Input
11 Output
12 Input
13 Input
14 I2C SDA
15 I2C SCL
16 0V

Pins 10-13 look like they may be build option resistors - two have 10K to +3.3v, two have 1K to ground.

the connector will take a standard 16 way 0.5mm jumper cable, e.g. Molex 0210200165 available from Digikey amongst others
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on October 25, 2013, 08:49:12 pm
Just received the shipping note of my ordered E4. So I will definately get an E4 before Flir is able to roll out a new "improved" firmware to all cameras.  >:D
Can't wait to receive it.
:clap: Kudos to Mike and all other contributors! :clap:
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on October 25, 2013, 08:51:00 pm
Looks like a normal startup deletes everything in temp - actually I think temp is a RAM volume as it's above the flash-x-FS directories

taken from camera.cmd:

Code: [Select]
$SHOW "Combined firmware (1.18.7) is intended for FLIR Z3-Series"
# Clean from potential earlier install
rmdir \temp\OS
rmdir \temp\APP
rmdir \temp\PROD
...
#Here if OS is not 16.0.10, mark OS for update
md \temp\OS

Those check do seem to imply at least a certain level of persistence. Then again, it could be leftovers from development on a persistent fs + "doesn't hurt to leave those checks in". So in the end ...  :-//

But can't you check the \temp mount point to find out what type of FS it is?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: PA0PBZ on October 25, 2013, 08:59:20 pm
prodapp.exe @ 19FB8:

Code: [Select]
LDR     R2, =aRestartingInHi ; "Restarting in high resolution mode/serv"...
LDR     R0, [R8,#0x54]
MOV     R1, #0
BL      sub_8F178
LDR     R1, =aW         ; "w"
LDR     R0, =aTemp__highres_ ; "\\Temp\\__highres.cnf"
BL      fopen
MOVS    R4, R0
BEQ     loc_19FF8
LDR     R0, =aHandsoff  ; "HandsOff"
MOV     R3, R4          ; FILE *
MOV     R2, #8          ; size_t
MOV     R1, #1          ; size_t
BL      fwrite
MOV     R0, R4          ; FILE *
BL      fclose
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 09:03:40 pm
Useful Hack no. 2...
To start service mode without using the web interface, just the console....
In normal mode copy some files as shown below into the images dir (seem to be some restrictions on where you can write - was getting quota type messages).
You can find the files by getting into service mode and FTPing  from \temp - Only need to do this once.

Add this batch file as serv.bat
Quote
md \temp\appcore.d\
md \temp\appcore.d\config.d
md \temp\appcore.d\factory.d
copy __highres.cnf \temp
copy conf.cfg \temp\appcore.d\config.d\conf.cfg
copy bw.rsc \temp\appcore.d\factory.d\bw.rsc
copy rndis.rsc \temp\appcore.d\factory.d\rndis.rs

Once done, you can now get service mode from the console after a cold start :
cd \flashifs\<wherever you put the files> - note PC must be disconnected)
serv
stopapp
restartapp

You are now in service mode. USB mode is RNDIS. This appears to be specified in rndis.rsc so may be chnageable - stay tuned.

The latter commands are batch files in flashbfs - should be possible to combine everything into a single batch file.







Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tom66 on October 25, 2013, 09:17:51 pm
Could those commands be placed in a sort-of autoexec.bat file (don't know if WinCE has a similar set up?) That way it enters service mode upon power up?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 09:25:21 pm
BTW note when restarting, there is a delay when it appears the keypad has frozen - this is just the startup time, and because progressapp isn't running you don't see a progress bar

Is the webcam output 320x240 when in service mode and is the framerate higher as well?
By default, USB is in RNDIS mode, so no webcam. The video over NDIS protocol does not appear to be implemented.
However if you modify  the USB mode string in rndis.rsc to "UVC_MSD", you are in service mode with mass-storage and UVC working as normal. Note I did this by copying the file from usb.rsc in the FW update so the CRC is right - I don't know if it actually checks the CRC though


Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 09:29:21 pm
Could those commands be placed in a sort-of autoexec.bat file (don't know if WinCE has a similar set up?) That way it enters service mode upon power up?
There is a file called applaunch.dat
Quote
# Show intro bootlogo and start progress
progressapp -f \flashbfs\system\bootlogo.bmp -g flashbfs\system\bootlogo_legal.bmp -d
# Start command shell on the RS-232 port
cmd /R
# Register a default user
defaultusr
# Start appcore. Appcore starts other necessary processes
appcore

However this may be dangerous as if the cmd/R isn't run you could find yourself locked out of the console  - the only potential way back in would be the hidden menu to enable RNDIS for telnet or FTP  access
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tom66 on October 25, 2013, 09:34:27 pm
So you could perhaps use a fork to launch a batch file - for example the "START" command on windows creates a second command interpreter and as long as the command interpreter can be found, the command should not fail.
But what I don't know is if this will open up a command window on top of the thermal image   :--
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on October 25, 2013, 09:35:04 pm
My guess is they only use CRC to check if the file transfer of new files (during a firmware upgrade) is succesful. During firmware upgrade it uses kitcrc for that.

Code: [Select]
kitcrc -c \FlashBFS\system\kits.d\appkit.rev
...
kitcrc -c \FlashBFS\system\kits.d\prodkit.rev

Based on kitcrc exit code it then says "Congrats" or "Screw you hippie!".

And you can probably add the RNDIS stuff to applaunch.dat by the looks of it. Probably want to make it create a file first time, then based on file existence do your extra stuff or not. That way you only execute your funky stuff first time around. In case of hang you reset and it will skip it.

What does cmd /? say btw? Apparently /R attaches it to rs232. Any other juicy options?

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on October 25, 2013, 09:37:34 pm
However this may be dangerous as if the cmd/R isn't run you could find yourself locked out of the console  - the only potential way back in would be the hidden menu to enable RNDIS for telnet or FTP  access

Nah. just make a file existence based bit of logic in the bat file that either does A or B. Make it so that reset toggles between executing branch A and B. And /obviously/ you test this mechanism first with something harmless. ;) Been there, done that, reflashed it. @_@
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 09:50:04 pm
Just tried adding the copy commands to applaunch.dat and no effect.
however commenting out appcore does stop the main app running.

Maybe applaunch.dat can only run executables

cmd /? :
CMD [/[C|K] command][/P][/Q][/T:bf]

  /C command  Runs the specified command and terminates.
  /K command  Runs the specified command and remains.
  /P          CMD becomes permanent and runs autoexec.bat
              (cannot be terminated).
  /T:bf       Sets the background/foreground color (see COLOR command).
\>Bad command or filename



maybe cmd /c copy.. might work - stay tuned...
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Stonent on October 25, 2013, 09:52:49 pm

However this may be dangerous as if the cmd/R isn't run you could find yourself locked out of the console  - the only potential way back in would be the hidden menu to enable RNDIS for telnet or FTP  access

Nah. just make a file existence based bit of logic in the bat file that either does A or B. Make it so that reset toggles between executing branch A and B. And /obviously/ you test this mechanism first with something harmless. ;) Been there, done that, reflashed it. @_@

When dealing with potential lockout situations (like fixing something remotely) I tend to start a timer of say 1 hour so if somehow whatever I did locks me out, when the timer runs out it either undoes it, reboots etc.

Useful when messing with network settings on a remote system.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 10:02:34 pm
not quite... Looks like the delete happens too soon - I can copy the files in, but by the time appcore starts, __highres.cnf has been deleted.


oh hang on a min, something has also deleted the dir I put on flashBFS with the files - maybe need to copy from flashifs... 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 10:11:46 pm
New applaunch.dat
Quote
# Show intro bootlogo and start progress
progressapp -f \flashbfs\system\bootlogo.bmp -g flashbfs\system\bocmd /c bootlogo_legal.bmp -d
# Start command shell on the RS-232 port
cmd /R
# Register a default user
defaultusr
cmd /C md \temp\appcore.d\
cmd /C md \temp\appcore.d\config.d
cmd /C md \temp\appcore.d\factory.d
cmd /C copy \flashifs\hack\__highres.cnf \temp
cmd /C copy \flashifs\hack\conf.cfg \temp\appcore.d\config.d\conf.cfg
cmd /C copy \flashifs\hack\bw.rsc \temp\appcore.d\factory.d\bw.rsc
cmd /C copy \flashifs\hack\rndis.rsc \temp\appcore.d\factory.d\rndis.rsc

# Start appcore. Appcore starts other necessary processes
appcore


Pwned.
Hang on, maybe not, but I did fiddle with a cfg file to try getting PIP.... stand by!



Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 10:28:42 pm
Panic over, definitely pwned  :) :D ;D :-DD :-DD
Tried 3 restarts from power-off and all good.

Oh, and standby/restart seems to work OK as well.

Interestingly with this hacked startup.dat, the startup progress bar actually works properly.

Putting the files in flashifs means you can fiddle easily via MSD interface, and disable the hack if necessary by just moving the files off.

Hopefully PIP and any other E8 goodies can be enabled - no more time to hack now.
 
Just make sure it isn't plugged into the PC when starting as the flashifs filesystem won't be mountable - it starts in standard mode.




Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 25, 2013, 10:39:21 pm
Even more RESPECT  :-+
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 10:45:14 pm
In the meantime, somebody please try to find that magic menu...!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on October 25, 2013, 10:50:48 pm
When dealing with potential lockout situations (like fixing something remotely) I tend to start a timer of say 1 hour so if somehow whatever I did locks me out, when the timer runs out it either undoes it, reboots etc.

More or less ditto for remote systems. For embedded like this I like the file existence approach so you can toggle execution branch.

But who cares about all that, I see Mike just undid it. Nice one!!  :clap:
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on October 25, 2013, 11:03:15 pm
Just tried adding the copy commands to applaunch.dat and no effect.
however commenting out appcore does stop the main app running.

Maybe applaunch.dat can only run executables

cmd /? :
CMD [/[C|K] command][/P][/Q][/T:bf]

  /C command  Runs the specified command and terminates.
  /K command  Runs the specified command and remains.
  /P          CMD becomes permanent and runs autoexec.bat
              (cannot be terminated).
  /T:bf       Sets the background/foreground color (see COLOR command).
\>Bad command or filename


hangonaminute! background processing in brain just finished. Note the absence of /R in that description. I bet someone grabbed the source of stock command, plonked in some code for serial console, handled /R argument, and didn't even update the help text. So for all you know the entire /A to /Z range is full of interesting functionality. ;)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: BravoV on October 25, 2013, 11:05:21 pm
Even more RESPECT  :-+

+1  :clap:

Another great moment of reverse engineering event documented live in this forum, thanks Mike.  :-+

Meanwhile, and again, when everytimes I watched great forum thread such like this one, just worry it might be locked or gone because of cease & desist .. love letter Dave received from lawyer.  :-//

Time to save or update an OFFLINE version of this thread.  ;)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 25, 2013, 11:13:21 pm
Mike,

You asked about the Germanium lens and its effects on calibration etc.

Some thoughts on the matter.

1. If FLIR are combining pixels in the 80x60 modes, the whole FPA will be 'in play' and illuminated by the lens.
2. If only the centre 80x60 pixels of the FPA were being used, the lens would be designed to illluminate that area of the FPA only ?
3. You have produced a hi-res image at 320x240 with the whole FPA 'in play'. I saw no vigneting so I believe the lens is illuminating the whole FPA. A lens change is therefore not essential which is good as they are not a common item on their own.
4. The quality of the lens used on the 80x60 E4 may be inferior to that of the E8 but whether most users would notice even at 320x240 is questionable.
5. FLIR calibrate their TICs in rows of test jigs, facing black body sources. The FPA thermal response should have been captured across all pixels and mapped. The lens is part of that calibration routine so a change of lens would reduce accuracy. The deviation would depend upon the similarity of the replacement lens to the original. Materials used, len thickness, coating and quality etc. Again, I doubt the change would be noticed by many users for the tasks that they had in mind. Adding a close-up lens to my PM695 made very little difference to the temperature calibration (but it is a very large and expensive close-up lens).
6. I have read of a company that is producing a new range of synthetic thermal camera lenses that would cost much less than Germanium. It is possible that FLIR might be using such in their low end cameras and a Germanium in their higher resolution units. This would be similar to web cams....some use plastic lenses, others HQ glass. Changing from a synthetic lens to a Germanium would likely be a major calibration difference due to differences in matrial 'through' losses.
7. A final thought. Lens diameter is very important in LW microbolometer cameras. To get good sensitivity the largest lens possible should be used. From your tear down I was not impressed with the tiny lens used in the E4, but the FPA is obviously very sensitive when compared to my units from the late 1990's so a small lens gives acceptable specs. There appeared little option for a larger lens in the E8 unless several parts were changed to accomodate such. I just don't see FLIR doing this on such a 'budget' line. 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on October 25, 2013, 11:20:19 pm
Even more RESPECT  :-+

+1  :clap:
definitely  :clap: ++

Quote
Time to save or update an OFFLINE version of this thread.  ;)

What? You mean you didn't mirror this thread and the entire Flir firmware exe/zip/iso/pdf collection?  :o

Gotta be prepared for when the pointy haired CatOutOfBag denial posse orders a fix with the next firmware update, only to fail horribly. Too late. :P

@Aurora:
So your educated guess is that most likely the E4 and E8 will use the same lens? That would be even better news. If so, that would seem to indicate the difference in temperature resolution between models is purely a processing issue.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 25, 2013, 11:31:03 pm
If lens diameter is fixed due to the mechanical constraints, the possibilities for differences in temperature resolution are

1. Different lens material
2. Different lens coating
3. Deliberate hobbling of lower spec E4 to encourage sales of higher spec units  ;)
4. Different FPA used in different models (there are two FPA models detailed in the OS)

I am suspecting FLIR may have gone for option 3 !

Mass production of a product like the E series is most cost effective if most mechanical and electronic parts are the same, with just firmware differences. The BoM is then kept as small as possible and the manufacturing line is simplified.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: BravoV on October 25, 2013, 11:33:29 pm
What? You mean you didn't mirror this thread and the entire Flir firmware exe/zip/iso/pdf collection?  :o

That post meant for provoking a further mass generation of the off-line mirrors, silly.  :box:
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 11:34:39 pm
There is a ton of stuff about lens calibration in the service menu.

The E series also seems to have this 'added noise' thing, disabled in service mode.
It could be that this makes the downsampled modes and the 60Hz-9Hz downsampling  work better with some added noise to reduce banding. Will do some playing if it will let me fiddle with the config files.
The 320x240 image looks fairly free of noise, but not tried setting a narrow band.
incidentally you can manually set the span and zero  by first locking the temp range and then using the 'level' and 'span' commands from the console.

I will be interested to see the E8 lens - there is potentially space for a bigger lens, but not hugely bigger.
At 9fps they can probably get away with the small lens as they have 6 frames to work with, so in principle 6x the SNR - the Ex0 range lenses look a lot bigger
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 25, 2013, 11:42:52 pm
Mass production of a product like the E series is most cost effective if most mechanical and electronic parts are the same, with just firmware differences. The BoM is then kept as small as possible and the manufacturing line is simplified.

Yes, though screwing on a different lens when a unit is calibrated and configured to be a specific model wouldn't be a big deal.
I'm pretty sure the present lens moulding envelope could accommodate a bigger lens
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 25, 2013, 11:46:53 pm
With regard to deletion of this thread....... would Dave do that ? He supports that Wiki Leaks chap doesn't he ? Freedom of speech and all that.

But seriously, the cat is well and tuly out of the bag, and FLIR know it. I suspect meetings have already taken place to decide what, if any, action will be taken  ;)  Sometimes less action is best in such cases, as it avoids negative publicity and FLIR will know that suppression of Mike's discoveries would be nigh on impossible. Sadly what is likely to happen is a change in firmware to block the 'hack' as that is cost effective and limits the damage to only the initial production batch.

The PR fallout for FLIR will revolve around the proven fact that they are using a 'full fat' 320x240 pixel FPA in their budget E4 camera. It will be apparent to all that the E8 is massively over priced as the hardware costs will be similar, if not the same. Historically I have had the view that the major cost in a TIC is the FPA and Gemanium lens. This E4 revelation tends to change that view as the 320x240 FPA and lens is obviously cheap enough to place in a lowly 80x60 spec camera.....if it were an expensive part due to resolution, such action would make no financial sense, and an 80x60 or 160x120 FPA would have been used instead.

The E4 in its 'hacked' state would make a very capable TIC for experimentation and consumer grade work. I do not see professionals in industry using hacked units though so the E8 will still sell to its target market. This is very much like the Rigol DSO hack, and I suspect it will play out in much the same way. One big diffrence with the Rigol was that it was using overclocked parts to achieve its spec, the FLIR is effectively using overspecified parts which is the inverse !

For me, as a TIC geek, this is a facinating develpment. I only wish I had the software skill-set that has been displayed here by Mike and the other members on ths 'Hack the E4' team. RESPECT to you all  :clap: 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: BravoV on October 25, 2013, 11:51:49 pm
With regard to deletion of this thread....... would Dave do that ? He supports that Wiki Leaks chap doesn't he ? Freedom of speech and all that.

Personally I believe Dave won't do that, but what can I say if he suffered enough legal pressures that are too hard to bear for him personally ?  :-//

I think we should move this discussion at another newly created thread maybe at General section, enough OOT contaminations in here already, sorry Mike, won't talk about it further here.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: equinoxe on October 25, 2013, 11:54:36 pm
  :clap:

Well done!!
BTW:
The word 3vlig (trevlig) is used in Swedish meaning nice! ;)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on October 25, 2013, 11:57:23 pm
What? You mean you didn't mirror this thread and the entire Flir firmware exe/zip/iso/pdf collection?  :o
That post meant for provoking a further mass generation of the off-line mirrors, silly.  :box:

Recursive: see recursive. Mission accomplished!  ;)

You did provoke me to feed the wayback machine however. So that's up to date as of now. I wish them the best of luck getting that deleted as well as random dropbox locations that may or may not pop up.

And yes, cat's out of the bag. Best move IMO is just to accept it. Yup, it happened, lesson learned. Silly fixes in future firmware will not work. They might as well enjoy the significant rise in E4 sales, and be happy.  :D
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on October 26, 2013, 12:00:54 am
So when's the video coming out? O0

BTW:
The word 3vlig (trevlig) is used in Swedish meaning nice! ;)

Interesting coincidence.
Or confirmation of my .rcc file induced suspicion that this was made by their Swedish software team. ;) That resource file is full of se.flir references.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 26, 2013, 12:01:38 am
I suspect a likely outcome is more sales of E4, Rigol style, not loss of E8 sales - The E8  looks overpriced for teh benefit it gives.
And it may also seriously piss off FLIR's competition. Neither of which would cause FLIR to lose much sleep. They can effectively gain sales and market share without openly price-slashing.
With the loosening of export controls on 320x240 cams I think we'll be seeing the price of this resolution falling a lot soon (notwithstanding hacks) - it's just a matter of which manufacturer jumps first, as 32x240 cams clearly have disproportionately  high margins at the moment.
 At this res, MSX type tech is much less of a bonus so manufacturers without it won't be at much of a disadvantage.

There are many ways they could have totally locked this down if they'd really wanted to. However big companies often don't give much consideration to it unless the're actively selling upgrades.

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 26, 2013, 12:08:15 am
So when's the video coming out? O0

BTW:
The word 3vlig (trevlig) is used in Swedish meaning nice! ;)

Interesting coincidence.
Or confirmation of my .rcc file induced suspicion that this was made by their Swedish software team. ;) That resource file is full of se.flir references.

I think it actually says something like "designed by Flir Sweden" on the label.

As regards "action" - what could they do? maybe Dave won't get the review units, but after the Rigol experience they would be insane to try anything heavy due to the Striesand effect.
All that has been done is revealing of how to use existing functionality, with reference to published documents. Though there were some hints from disassemblies, these were not essential, and no copyright information has been re-published.

If Flir are pissed off with anyone, it should be with their own developers for lazily re-using code without taking out unnecessary functionality. Assuming of course it was unintentional.

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 26, 2013, 12:12:39 am
Mike,

I may be totally wrong as you know more about the firmware than me, but I have not herad of this noise insertion technique in a TIC before. Bit padding, yes, but not noise insertion.

The Uncooled Microbolometer is a noisy beast and much time and money has been spent trying to tame it  in order to provide nice clean images with as little internally generated noise as possible. My 1st Generation FPA PM570 is pretty noisy when compared to the later 3rd Generation FPA PM695 on this front. FLIR have spent a lot of time developing the FPA and also the noise REDUCTION algorithms and capabilities. As you know, my PM695 has 3 modes for noise reduction.

1. Off - for fast moving targets like cars and animals etc.
2. Normal - Everyday observation, hand held, non fast moving targets.
3. High - Lowest noise mode for static targets only and tripod mounting of camera is essential.

Having used these modes, it appears the noise reduction works by comparing captured frames and deleting the random elements before display. The frame rate appears much slower as a result. The PM695 provides a very nice image in the 'Noise redcuction OFF' mode and you can pan the camera easily. With the mode set to 'High', any movement of the camera or target causes really impressive image smearing and pixelation.

I would be amazed if FLIR did not employ noise suppression in the E series. Is it not possible that the noise suppression is switched OFF in service mode to provide the raw, fastest update without interferance from the noise algorithms and processes. That is what I would do in a service mode. Keep it to raw basics, without any bells or whistles active to confuse the testing or CALIBRATION  ;)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 26, 2013, 12:26:45 am
Mike,

I may be totally wrong as you know more about the firmware than me, but I have not herad of this noise insertion technique in a TIC before. Bit padding, yes, but not noise insertion.

The Uncooled Microbolometer is a noisy beast and much time and money has been spent trying to tame it  in order to provide nice clean images with as little internally generated noise as possible. My 1st Generation FPA PM570 is pretty noisy when compared to the later 3rd Generation FPA PM695 on this front. FLIR have spent a lot of time developing the FPA and also the noise REDUCTION algorithms and capabilities. As you know, my PM695 has 3 modes for noise reduction.

1. Off - for fast moving targets like cars and animals etc.
2. Normal - Everyday observation, hand held, non fast moving targets.
3. High - Lowest noise mode for static targets only and tripod mounting of camera is essential.

Having used these modes, it appears the noise reduction works by comparing captured frames and deleting the random elements before display. The frame rate appears much slower as a result. The PM695 provides a very nice image in the 'Noise redcuction OFF' mode and you can pan the camera easily. With the mode set to 'High', any movement of the camera or target causes really impressive image smearing and pixelation.

I would be amazed if FLIR did not employ noise suppression in the E series. Is it not possible that the noise suppression is switched OFF in service mode to provide the raw, fastest update without interferance from the noise algorithms and processes. That is what I would do in a service mode. Keep it to raw basics, without any bells or whistles active to confuse the testing or CALIBRATION  ;)
I've not played - the only reason I assumed it was noise addition was a comment/assumption from the guy whol emailed about the i series hack.
Quote
.caps.config.image.targetNoise.enabled bool true
.caps.config.image.targetNoise.targetNoiseMk int32 135
It could actually be noise reduction or shaping - maybe this is a threshold to decide when to apply noise reduction, i.e. adjust filter until noise is below the target value.  "Mk" - mask? Perhaps something like a hysteresis function?
Either way it would make sense to not do it in service/cal  mode.

Also don't forget that there may be other issues in service mode that haven't been spotted yet - need to compare some known reference images to check cal. I've left it running all day at home to see if there's any timeout etc. 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 26, 2013, 12:35:53 am
I can't help feeling that, with the 320x240 resolution, MSX has just 'crashed and burned'   :-//

I still like the idea on low resolution TICs and when there is low thermal difference between objects in the field of view.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 26, 2013, 12:50:09 am
I can't help feeling that, with the 320x240 resolution, MSX has just 'crashed and burned'   :-//

I still like the idea on low resolution TICs and when there is low thermal difference between objects in the field of view.
Absolutely - MSX on the 80x60 makes it much more useful, and for many applications, is close to as useful as higher thermal resolution, so for low-budget users it's a viable alternative to higher res cams. Without it, even at £800 an 80x60 cam would be disappointing. Considering the minimal cost of a visible camera it's a no-brainer.
The only time it really fails is when light levels are low, but all you need is a torch. Higher-end models have illuminators.

One enhacemant that would be nice is automatic distance calibration - this could be done in 2 ways - point at an object with vertical edge in the thermal image and presss a button to make it look for teh best correlation with edges in the visual, or a second visible camera below the main lens - by correlating images from the two visible cameras it could continuously auto-scale the distance.   

Something I don't really feel any need for is higher framerate - even without any ITAR issues, the cost saving of being able to use a smaller lens to improve SNR is probably a pragmatic solution. I guess framerate becomes more important for night-vision type apps, or if you have autofocus. 
 It will be interesting to look at the raw 60FPs data though, but I won't have time for that for a while.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 26, 2013, 01:21:29 am
60fps is a must for high speed thermography of targets moving through the field of view. 9fps is fine for static objects.

I recall that someone saw an E5 camera running at 60 fps at a German exhibition ? I don't think I dreampt it. If so, the lens may not be such a limiting factor.

I remain surprised that the UI is so sluggish on this camera. From your investigations, it appears to use a powerful main processor. I wonder if the image processing hogs the MIPS ? FLIR need to fix that. Possibly verbose, inefficient programming combined with Win CE OS ?

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 26, 2013, 01:31:01 am
Now heres a question for you all......

The E4 is fast giving up its secrets and the MSX capability is becoming mute.

There are a lot of FLIR i3's out there........Hmmmmm I wonder if they can be upgraded in a similar manner ? i3's should be being discounted soon, and cheaper on the used marketplace due to the E4's arrival. We know the i7 can be hacked.

FLIR would not be able to lock the firmware on those old i3 stocks, or units already sold   :)

Ask yourself whether the E4 offers ANYTHING better than an i3 when MSX is removed from the equation  >:D

Cheap 320x240 TIC anyone  ;D
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on October 26, 2013, 01:42:09 am
If you want one, you might better hurry up to get one. I ordered my E4 this night which is (luckily) already on its way.
I just checked the supplier again: the E4 suddenly is out of stock at this supplier and also at another supplier - both had them on stock this night.
Either the E4 are now sold out quickly because of this thread or Flir is pulling the stock back for implementing a new firmware.




Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 26, 2013, 01:43:34 am
60fps is a must for high speed thermography of targets moving through the field of view. 9fps is fine for static objects.

I recall that someone saw an E5 camera running at 60 fps at a German exhibition ? I don't think I deampt it. If so, the lens may not be such a limiting factor.

I remain surprised that the UI is so sluggish on this camera. From your investigations, it appears to use a powerful main processor. I wonder if the image processing hogs the MIPS ? FLIR need to fix that. Possibly verbose, inefficient programming combined with Win CE OS ?
Probably - when inside a fullscreen menu it shouldn't actually be doing anything else at all so no reason for it to be slow. I suspect the issue is there are many layers in the way of doing what is a simple task - another casualty of using a software framework designed for higher-end products.
I saw plenty of non-optimalities in the ARM code, but not sure to what extent this is due to the compiler itself or the API layers hiding things that the compiler could optimise if it knew about them.

Sluggishness in thefullscreen option menus isn't a major deal as you hardly ever need to go there, and the onscreen popups are just about acceptable
My biggest complaint by far is that you need to pull up the menus to select between simple functions, in particular image mode and target distance.
I was told that FLIR are working on improving this in a future release. 

It may be that it is being slowed by image processing, but this should be turned off when inside fullscreen menus.
My belief is that all the processing happens in the FPGA, and all the SoC does is overlay the menus.
 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 26, 2013, 01:46:01 am
Now heres a question for you all......
There are a lot of FLIR i3's out there........Hmmmmm I wonder if they can be upgraded in a similar manner ? i3's should be being discounted soon, and cheaper on the used marketplace due to the E4's arrival. We know the i7 can be hacked.
AFAIUI the i3 can be made into an i7, which was the subject of the lost email, but even the i7 is only 120x120
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 26, 2013, 01:57:07 am
Oh Poo. That idea squashed then  :'(
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 26, 2013, 02:00:57 am
If you want one, you might better hurry up to get one. I ordered my E4 this night which is (luckily) already on its way.
I just checked the supplier again: the E4 suddenly is out of stock at this supplier and also at another supplier - both had them on stock this night.
Either the E4 are now sold out quickly because of this thread or Flir is pulling the stock back for implementing a new firmware.
hard to tell as not many online dealers have any in-stock indication - tester/Pass are showing stock, but I couldn't see any product that wasn't, which is always suspect

There are currently two from dealers Buy It Now on Ebay UK.
shopflir.com ni US  are showing 2 ready to ship


Oddly the E series doesn't seem to have hit RS or Farnell yet, though Farnell have 8 i3s left to shift
ticameras have a big splash screen for the i3 on their home page - also probably trying to shift old stock. Showing E4 in stock

I doubt they would bother trying to pull stock - would probably cause them more hassle and reputation damage than any  loss through hacks.


Title: Re: Flir E4 Thermal imaging camera teardown
Post by: firewalker on October 26, 2013, 07:49:48 am
A recap video for the hack would be awesome!

 :-+ :-+ :-+ :-+

Alexander.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 26, 2013, 07:54:23 am
It doesn't seem to like having the conf.cfg file edited, so may be checking the CRC, probably tricky to enable other features  :(
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: TopLoser on October 26, 2013, 08:01:53 am
Oddly the E series doesn't seem to have hit RS or Farnell yet, though Farnell have 8 i3s left to shift

Farnell have taken the decision to no longer supply FLIR equipment, they are concentrating on Fluke as their supplier of thermal imaging equipment.

The 8 i3s they have left are open to offers to clear them out.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on October 26, 2013, 08:11:29 am
It doesn't seem to like having the conf.cfg file edited, so may be checking the CRC, probably tricky to enable other features  :(

Just add a comment with appropriately crafted text at the end of file, to end up with the same CRC as the original. Easy enough with that 16-bit CRC I'd think. ;)

Edit: the only real sport would be to make it an ascii art comment, and then still try to end up with the correct CRC. Regular comment would just be too easy.  ;D
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 26, 2013, 08:14:23 am
Oddly the E series doesn't seem to have hit RS or Farnell yet, though Farnell have 8 i3s left to shift

Farnell have taken the decision to no longer supply FLIR equipment, they are concentrating on Fluke as their supplier of thermal imaging equipment.

The 8 i3s they have left are open to offers to clear them out.
I'll give 'em a Monkey for the lot.. ;)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on October 26, 2013, 08:21:17 am
I'll give 'em a Monkey for the lot.. ;)

You sure about that? Have you checked the pricing on those monkeys lately?  :o I mean, come on!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Monkeh on October 26, 2013, 08:22:41 am
I'll give 'em a Monkey for the lot.. ;)

You sure about that? Have you checked the pricing on those monkeys lately?  :o I mean, come on!

We don't come cheap.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 26, 2013, 08:26:28 am
Correction to connector pinout :
BTW updated connector pinout
Starting from end nearest to the unpopulated FFC connector

1 Power - Vbattery during run and charge - possibly via a FET switch as I didn't see continuity to bat terminal
2 On/Off switch (to ground)
3 Console RXD
4 Console TXD
5 Debug  RXD
6 Debug TXD

7 /Reset
8 0V
9
10
11
12
14 I2C SDA
15 I2C SCL
16 0V

Pins 10-13 look like they may be build option resistors - two have 10K to +3.3v, two have 1K to ground.

the connector will take a standard 16 way 0.5mm jumper cable, e.g. Molex 0210200165 available from Digikey amongst others
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 26, 2013, 08:27:42 am
I'll give 'em a Monkey for the lot.. ;)

You sure about that? Have you checked the pricing on those monkeys lately?  :o I mean, come on!
You missed the Cockney accent - a Monkey is five 'undred quid guv'nor
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Noize on October 26, 2013, 08:33:01 am
I'll give 'em a Monkey for the lot.. ;)

You sure about that? Have you checked the pricing on those monkeys lately?  :o I mean, come on!


Cockney Slang
Tenner:
£10

Pony:
£25

Half a Ton:
£50

Ton:
£100

Monkey:
£500

Grand:
£1000
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Nermash on October 26, 2013, 08:33:51 am
Only if Monkey Harris is selling them :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: aargee on October 26, 2013, 08:38:16 am
That's like a Funky Gibbon, right?

Mike (and others) thanks for the excellent work and great reading in this thread  :-+

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 26, 2013, 08:41:31 am
I'll give 'em a Monkey for the lot.. ;)

You sure about that? Have you checked the pricing on those monkeys lately?  :o I mean, come on!


Cockney Slang
Tenner:
£10

Pony:
£25

Half a Ton:
£50

Ton:
£100

Monkey:
£500

Grand:
£1000
also : MGarrett £50 (from Hawaii 5-0), Score £20, Carpet £30, Archer £2000
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nixxon on October 26, 2013, 08:44:59 am
What may limit the FLIR E-series attractiveness for certain applications are the lack of:
* manual Temperature Span
* manual Temperature Level

And, of course, the non manual focus...

But a possible 16x resolution (pixel count) is of course a killer asset

What is the big deal about this possible hack for hobbyist use?

(don't get me wrong; I love the hacking as such, but otherwise? I guess the only downside for FLIR is that their sales will boost bigtime, just like Rigol's sales did after the DS1052E-hack)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 26, 2013, 09:01:19 am
What may limit the FLIR E-series attractiveness for certain applications are the lack of:
* manual Temperature Span
* manual Temperature Level
You can lock to the current range, and if you're really keen you can set range and span via the console interface or over RNDIS
Quote
And, of course, the non manual focus...
The lens can be adjusted in-situ with the right tool - am investigating how to make one.
Quote

What is the big deal about this possible hack for hobbyist use?
A previously £4K+ camera for £800
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nixxon on October 26, 2013, 09:08:35 am
What may limit the FLIR E-series attractiveness for certain applications are the lack of:
* manual Temperature Span
* manual Temperature Level
You can lock to the current range, and if you're really keen you can set range and span via the console interface or over RNDIS
Quote
And, of course, the non manual focus...
The lens can be adjusted in-situ with the right tool - am investigating how to make one.
Quote

What is the big deal about this possible hack for hobbyist use?
A previously £4K+ camera for £800
IR for the masses !
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 26, 2013, 09:37:31 am
Dave, willing to do some tests on the E8 for us?  ;) I can see you watching.
Please - someone find the magic keypresses so Dave can dump the eeprom and config files without opening it!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 26, 2013, 09:59:50 am
Is this useful for Electronics... you tell me...?
This is with the lens screwed out a couple of turns for close focus

The track is a 12.5mil carrying 1 amp.

The nice thing about looking at PCBs is there are plenty of shiny things to give contrast so you can see very clearly where you are, even when it isn't hot. Lack of MSX close-up is just not an issue.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 26, 2013, 10:26:12 am
TL;DR : Summary of Hack

Update 27/10 - some info in this post  is wrong - the conf.cfg file is specific to the serial number so the one (removed) in this zip won't work.  You need to get your own by entering service mode via RNDIS, and copying the \temp\appcore.d\config.d\conf.cfg file it generates into \flashifs\hack
(Note I have sometimes seen flashifs getting renamed during service mode so it may be flashifs2)

This hack puts the E4 permanently into service mode. This gives full 320x240 resolution, hotspot/coldspot measuring mode and some more palette options.
The hack can be removed or hidden as desired via the USB interface.
It has only been tested with Firmware V1.18.8 It seems likely that 1.18.7 may be also OK looking at the update files.
WARNING There is a risk of bricking if you do stupid things. It may be possible to recover via USB bootloader menu but it is not known if this works with standard firmware files or FLIR tools. 
In particular, if the applaunch.dat doesn't get to cmd /R, you may not be able to get back to a console prompt to fix any file problems, which would be bad, m'kay
Hack at your own risk.


Power up and plug USB into PC.

Copy all files from attatched zip to a new folder called hack in the root of the USB drive

Unplug USB.

Connect to serial console using Hyperterminal or similar  (38400 baud)
Press enter a few times - you should see the \> prompt
At prompt type :
cd \flashbfs\system
copy \flashifs\hack\applaunch.dat
  (Hit 'Y' at the confirmation prompt )
 type applaunch.dat ** to check this file looks correct as a bad copy could brick the unit!

Power down (remove battery), and restart
Enjoy!


Notes :

If hack folder or  files deleted or renamed, unit will start as normal E4. Will revert to hacked when folder replaced.

Make sure unit is not plugged into PC USB when cold booting
- PC prevents bootup accessing hack files - unit will start as normal E4. Will start as hacked next time cold-booted without USB plugged in.
Quick way to tell if hack active - hotspot/coldspot measurement modes available
--------------------------------------------------------------------
Optional :
copy rndis_rndis.rsc over rndis.rsc to make USB work as RNDIS instead of mass storage+USB Video
copy rndis_MSD_UVC.rsc over rndis.rsc to restore to mass storage+USB video
This allows console access via telnet, file transfer via FTP and web access to service functions

FTP and web username flir, password 3lvig
Default IP 192.168.0.2 ( check using ipconfig)
You can do this at any time, cold reboot afterwards.

--------------------------------------------------------------------------

Changing startup screen (cold boot only)
Replace \flashbfs\system\bootlogo_legal.bmp ( copy from USB filesystem as per other files)
Original is 8 bpp windows bitmap.
Beware of changing format, as if progressap crashes it may not run the console prompt

--------------------------------------------------------------------------

Pinout for serial console

FFC connector accessable under label on front of lens housing
Looking at lens side with handle down


<left edge> <pin 16>....<pin 1>
Contacts are on bottom side (towards handle)
Pin 3 RXD
Pin 4 TXD
Pin 7 ground

Use 3.3v TTL level interface, e.g. FTDI TTL-232-3v3 cable

TTL232 Pin 1 (0v) to ground
TTL232 Pin 4 (TXD) to RXD
TTL232 Pin 5 (RXD) to TXD

Suggested FFC jumper cable molex Molex 0210200165 or similar.
--------------------------------------------------------------
De-hacking
Removing the hack folder will make it start as per normal E4.
If desired you can replace the hacked applaunch.dat with a copy of the applaunch_original.dat
This should return it to full factory condition.

This hack will be overwritten by a firmware update, as applaunch.dat will be overwritten.

See pic for FFC for position to access with just the 2 front screws - you may need to push away some rubber padding to get to it, and will need to tape your FFC cable to some rigid PCB to push it in.

Next time I get some PCBs done I'll do some FFC breakouts - PM me if interested

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 26, 2013, 10:30:51 am
PS one thing I've not yet checked is whether battery charging works properly - this involves different bootup modes so could plausibly be issues - if there are issues, worst-case you may need to move hack files via USB when charging.
Need to let my battery run down a bit to check.
 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Psi on October 26, 2013, 10:38:54 am
Mike is awesome and making us spend money   :-DD


New phone + Oculus rift   or   a Flir E4
3rd world problems :(


I do agree with what someone said a while back. With the 320x240 hardware now costing $995 including the profits for Flir and the distributor it seems likely that they're only going to get cheaper.
There's an opportunity for a new company to start selling official 320x240 TIC for <$1000

The only possible exception to this is if the lens or sensor in the E4 was bin'ed as reject, which would otherwise be thrown away.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Stonent on October 26, 2013, 10:41:06 am
Ok if we ever have a need for a real world A-Team. I'm calling dibs on Mike.  :-+
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 26, 2013, 10:55:08 am
Quote
There's an opportunity for a new company to start selling official 320x240 TIC for <$1000
Assuming they could buy sensors at the right price, which probably means high volumes.
Quote
The only possible exception to this is if the lens or sensor in the E4 was bin'ed as reject, which would otherwise be thrown away.
The service info on mine showed no dead pixels - it does appear to have the ability map out (mask) dead pixels.
Unless they have significant yield issues, it may well be more hassle than it's worth to to sort out useable rejects from non-useable ones.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: IanB on October 26, 2013, 11:56:38 am
I may be totally wrong as you know more about the firmware than me, but I have not heard of this noise insertion technique in a TIC before. Bit padding, yes, but not noise insertion.

Maybe I'm preaching to the choir, but noise addition and oversampling is a standard technique for getting more resolution out of a low res sensor (by resolution, I mean more bits per pixel, not more pixels). Essentially you are oversampling the A/D converter. Instead of taking one sample, you take many samples and average them. By itself this may not help much due to sampling bias, but if you add random noise to the input signal and then take multiple samples you can get more bits per reading at the cost of longer time to obtain each reading. By averaging over many samples you not only can get higher resolution (e.g. 9-12 bits from an 8 bit sensor), but you also can reduce noise by averaging it out.

(The way this works is as follows: statistically speaking, an analog value of 37.4/255 on an 8 bit A/D is likely to produce a reading of 37 most of the time. But if you add some random noise and sample multiple times, you will get a reading of 37 about 60% of the time and a reading of 38 about 40% of the time. By averaging over several readings, you will obtain a better estimate of 37.4 rather than 37 or 38.)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Richard Wad on October 26, 2013, 07:41:33 pm
Dave, willing to do some tests on the E8 for us?  ;) I can see you watching.
Please - someone find the magic keypresses so Dave can dump the eeprom and config files without opening it!

Hello Mike
First post here, thought I'd say a huge thanks for your efforts on this. I happen to have an E4 also.

Curious, how many possible key presses do you think this could entail? If we include the power on button, there are 8 buttons. If flir chose to make this more difficult, could they have perhaps chosen 2 buttons  to be depressed at the same time?

I can work on this if it exists, how will I know if/when the dump has occurred?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 26, 2013, 07:54:23 pm
Dave, willing to do some tests on the E8 for us?  ;) I can see you watching.
Please - someone find the magic keypresses so Dave can dump the eeprom and config files without opening it!

Hello Mike
First post here, thought I'd say a huge thanks for your efforts on this. I happen to have an E4 also.

Curious, how many possible key presses do you think this could entail? If we include the power on button, there are 8 buttons. If flir chose to make this more difficult, could they have perhaps chosen 2 buttons  to be depressed at the same time?

I can work on this if it exists, how will I know if/when the dump has occurred?
It appears that the hidden menu is are "after" the info (model/ersion/serial no) in the settings->camera information menu ( all entries appear the same). Current best guess is that some key combination at startup (presses or keys held) will enable the additional menu, probably visible by a right-arrow or enter on these menu items.
The i series uses 2 keys pressed together at some point after startup, one of which was an arrow key. My guess would be this is detected after the bootloader - first FLIR screen before export message.
And probably only on a cold boot (battery insert)
Stay tuned to this thread for info - code is disassembled - I'm not working on it but others are.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Richard Wad on October 26, 2013, 08:18:50 pm
Hi Mike
You're up late. Or early!
OK well I have some time on my hands so I will try all the key combos I can come up with and let you know.
Will it dump to its internal storage the data you are seeking?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Psi on October 26, 2013, 08:22:12 pm
The files he wants to dump on an E8 unit isnt an automatic thing. It requires enabling RNDIS and running some commands.

Finding the key combo to get the service menu means this data can be dumped out without taking the unit apart. (Since Dave doesn't want to do that to an E8 on loan.)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Richard Wad on October 26, 2013, 08:29:56 pm
Thanks
Is that on the camera side through the serial connection, enabling RNDIS?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 26, 2013, 08:39:54 pm
Just had this message  re. i7
The secret key combo for the i7 is to bring up the menu and hold down the gallery key for 5 seconds. The code for it is very visible in gui.exe as it uses a timer and is written in .Net (so it's super easy to disassemble). Perhaps if you disassembled your gui.exe it might be in there?

Also, no special boot conditions are required to enter the service menu. Nor does the key combo need to be pressed during startup.

I got into my i7 some time ago (I was also too nervous to release it ;) ), but I am yet to figure out the "CRC" algorithms on the config files. I think this is the key to modding it, and I think it seems to be based on some sort of RIPEMD160 and uses some sort of ID as a seed (perhaps camera serial number?). I know that the FLIR i7 definitely uses a 320x240 sensor and that they run factory calibration at 250x250 (the sensor is actually 336x252 or something funny like that).

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 26, 2013, 08:43:49 pm
Thanks
Is that on the camera side through the serial connection, enabling RNDIS?
At the moment you need a serial connection, accessable after removing 2 screws to get the facia off. Once you have this you don't need RNDIS as you can copy files between the user file area. The only thing that can only be done via RNDIS is the service/cal functions.
If we can find the secret menu to enable RNDIS via the keypad, then it can be done without opening the case,via telnet
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: cartti on October 26, 2013, 09:41:06 pm
Can someone share files that are not included in the fw update pack? (gui and cmd)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: amyk on October 26, 2013, 10:03:52 pm
:clap:

It could be that those extra menus are triggered by the presence of a file (like the highres mode), which is put there at the factory and gets deleted afterwards - thus locking the functionality out and requiring physical access to restore.

...How long until homebrew firmware running on this, with a better non-laggy UI and more functionality? The hardware doesn't seem all that complex to work with.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 26, 2013, 10:17:51 pm
Can someone share files that are not included in the fw update pack? (gui and cmd)
I've not found a way to copy off .exe files - it doesn't let you copy to another drive or FTP - may try booting in safe mode to see if this helps. Would be good to know all the modes of usbfn as it would be handy to have RNDIS, MSD and UVC all working.

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on October 26, 2013, 10:33:25 pm
Quote
It has only been tested with Firmware V1.18.8 It seems likely that 1.18.7 may be also OK looking at the update files.
Just to let everybody know who is thinking about a purchase: the E4 I yesterday purchased online (and which just arrived) in Germany has Firmware 1.18.8. Hardware information says its "E4 1.0".
Unfortunately I cannot proceed now with the hack .... vacation time!
It has to wait now for a week..... can't wait to return to hack it.

But even in 80x60 mode I can say so far: due to MSX even this low res is quite useful, that was a clever idea from Flir.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 27, 2013, 12:09:19 am
It could be that those extra menus are triggered by the presence of a file (like the highres mode), which is put there at the factory and gets deleted afterwards - thus locking the functionality out and requiring physical access to restore.
Seems unlikely - at the factory they have a physical connection available so wouldn't need a way to configure via the keypad. I also doubt it would involve putting stuff on the user partition, as the settings could prevent access to this, though one possibility could be that it will only do it of it sees USB power.
Keeping it simple seems to me to be the most likely approach, not depending on anything that could be inaccessible under certain conditions
Quote
...How long until homebrew firmware running on this, with a better non-laggy UI and more functionality? The hardware doesn't seem all that complex to work with.
A possibility, but how much more functionality would there need to be to make it worth the effort? You'd also need to include their FPGA file, but if you left the factory filestructure in place, it would be in there anyway.
Assuming (as seems likely) the FPGA does most of the work and feeds a ready-to-display combined image into the camera interace it may not be a huge effort for someone who knows the processor. The main thing you'd need to figure out is how it talks to the FPGA and what data is passed  - likely to be an I2C or SPI interface.
A potential issue may be getting the bootloader to load foreign code.
There is also the issue of figuraing out how factory cal data is dealt with.

.so what other functionality might be useful...?
Higher framerate is the obvious one, though may need a bigger lens to be useful.
Higher temperature  resolution at lower framerate
Video recording, but memory capacity, and maybe CPU power for compression may be limiting.
Timelapse/ take pictured on motion detection (good for wildlife?)
Auto MSX distance detection ( may not have access to both datastreams though)
Some of these would be doable by plugging into PC/RasPi etc.

Not sure I can see it happenning.

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: PA0PBZ on October 27, 2013, 12:44:50 am
I unpacked NK.bin and have a zip file available to anyone interested (174 files, 4.4Mb zipped)

https://www.dropbox.com/s/g7ix9z3idp1zxsa/nk.zip (https://www.dropbox.com/s/g7ix9z3idp1zxsa/nk.zip)

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 27, 2013, 01:21:53 am
Cool! has all the Windows files that it won't let me copy.
CMD.exe has some bitmaps inside, including an image of the command prompt - odd
autoloadcheck.exe has a FLIR logo - boot screen (startup or wake from sleep) perhaps
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: cartti on October 27, 2013, 02:04:52 am
I unpacked NK.bin and have a zip file available to anyone interested (174 files, 4.4Mb zipped)

https://www.dropbox.com/s/g7ix9z3idp1zxsa/nk.zip (https://www.dropbox.com/s/g7ix9z3idp1zxsa/nk.zip)
Thank you. These are from different model (mips processor), so ppl do not even try using these in E4. :)

Edit: Still missing GUI.exe tho, grr..  |O
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 27, 2013, 02:35:53 am
I unpacked NK.bin and have a zip file available to anyone interested (174 files, 4.4Mb zipped)

https://www.dropbox.com/s/g7ix9z3idp1zxsa/nk.zip (https://www.dropbox.com/s/g7ix9z3idp1zxsa/nk.zip)
Thank you. These are from different model (mips processor), so ppl do not even try using these in E4. :)

Edit: Still missing GUI.exe tho, grr..  |O
Are you sure - references to ASCO, and build date of September.
I don't have cam to hand to compare - will check later
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: cartti on October 27, 2013, 02:56:47 am
I unpacked NK.bin and have a zip file available to anyone interested (174 files, 4.4Mb zipped)

https://www.dropbox.com/s/g7ix9z3idp1zxsa/nk.zip (https://www.dropbox.com/s/g7ix9z3idp1zxsa/nk.zip)
Thank you. These are from different model (mips processor), so ppl do not even try using these in E4. :)

Edit: Still missing GUI.exe tho, grr..  |O
Are you sure - references to ASCO, and build date of September.
I don't have cam to hand to compare - will check later
# Format      : Portable executable for MIPS R4000 (PE)

Oh wait. Some of the files are for ARM and some for MIPS. CMD.exe and some .dll's were Mips that i looked through, but now after looking at some random other files they are for ARM.

Maybe fw installer just picks right files for right model or?...
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: PA0PBZ on October 27, 2013, 03:29:38 am
Not sure, but these are from the Z3comb_v1.18.7 I downloaded from the Flir web site as the update for Ex.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 27, 2013, 03:47:37 am
Not sure, but these are from the Z3comb_v1.18.7 I downloaded from the Flir web site as the update for Ex.
I had an old ARM disassembler bork at E4 files complaining they weren't ARM - maybe  some confusion over processor ID headers somewhere.
What are you using to look at them & how old is it?
Will compare with installed files when I get home.
 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: PA0PBZ on October 27, 2013, 04:27:19 am
I looked at the cmd.exe COFF file header and yes, the machine type field (at offset 0xC4) says 0x166, that's MIPS for sure.
I checked a few others and they all have 0x166. I'm beginning to think that NK.bin has 2 sections and I unpacked the wrong section.

To be continued...

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on October 27, 2013, 04:35:11 am
I'm beginning to think that NK.bin has 2 sections and I unpacked the wrong section.

What did you use to extract from .bin?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: PA0PBZ on October 27, 2013, 04:46:39 am
What did you use to extract from .bin?

I used NKtools, that seems to be the way to go. I don't think there is another section in the NK.bin, since the size is almost exactly the size of the extracted files, and I don't think there is any compression.

From camera.cmd (the update tool):

Code: [Select]
$LABEL checkinstallOS
dir /B \temp
[*OS*][$GOTO os]
$GOTO checkinstallOSEnd
$LABEL os
# Install OS here
# $SHOW "Updating OS"
delete nk.bin
delete nk.crc
delete gethwtype.exe
delete osimg.rev

#
#
addfile /nk.bin
addfile /nk.crc
## 70
#
kitcrc -c \nk.crc
[*FAIL*][$FAIL "Bad checksum on transferred OS",3]
$TIMEOUT 360
flash -l -n nk.bin
#
$LABEL checkinstallOSEnd

So it looks like they just flash the bin file, I'm puzzled  :-//
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: PA0PBZ on October 27, 2013, 05:10:13 am
Ok, so kernel.dll has the 0x166 signature for MIPS, but also has the text "Windows CE Kernel for ARM (Thumb Enabled) Built on May  7 2012 at 12:47:43".  :wtf:
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: PA0PBZ on October 27, 2013, 05:33:10 am
I changed the signature of cmd.exe from MIPS (0x166) to ARM (0x1C2) and IDA disassembles it perfecty as ARM. I'm beginning to think that someone somewhere has a weird sense of humor.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: SeanB on October 27, 2013, 05:35:48 am
Security by ROT13....................
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 27, 2013, 05:49:31 am
Security by ROT13....................

...like renaming that .cab file as .fif.....
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: PA0PBZ on October 27, 2013, 06:16:52 am
...like renaming that .cab file as .fif.....

That's just Flir Industries Firmware  :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: dustout on October 27, 2013, 06:25:01 am
On the i3 I was able to pull up the Service Menu (by pulling up the menu then holding Play/Gallery button).  Lots of version information is displayed and a menu with the options:
* Dump Info (creates a postlog.txt & versions.rsc file on the SD card with various information inside)
* USB Mode -> MSD, RNDIS
* Update Firmware

Unfortunately I don't see any way to modify anything else within this.  I can enable RNDIS for USB using this method and it shows up on the computer as a 10Mbps Network Interface but unfortunately I've only been able to ping its gateway IP. No success with telnet, http, and ftp to the Flir Network Device's gateway (192.168.1.1 in my case) nor its DHCP server (192.168.1.2).  I did discover that if I hold Menu + Up Arrow on boot-up it will display some bootup text beneath the status bar as it boots although it is severely cut off as the text is within a small black box.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 27, 2013, 06:45:54 am
On the i3 I was able to pull up the Service Menu (by pulling up the menu then holding Play/Gallery button).  Lots of version information is displayed and a menu with the options:
* Dump Info (creates a postlog.txt & versions.rsc file on the SD card with various information inside)
* USB Mode -> MSD, RNDIS
* Update Firmware

Unfortunately I don't see any way to modify anything else within this.  I can enable RNDIS for USB using this method and it shows up on the computer as a 10Mbps Network Interface but unfortunately I've only been able to ping its gateway IP. No success with telnet, http, and ftp to the Flir Network Device's gateway (192.168.1.1 in my case) nor its DHCP server (192.168.1.2).
Time to look for some serial ports then...
Quote
I did discover that if I hold Menu + Up Arrow on boot-up it will display some bootup text beneath the status bar as it boots although it is severely cut off as the text is within a small black box.
E4 does that if any key is pressed at startup - same text as you get from the debug port, but not very readable
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 27, 2013, 09:27:09 am
More i7 whispers :

The trick used to dump the i7 is via the visual studio remote debugging tools (you can copy files onto the device, right?). You *need* to be using visual studio 2008/2010. Once you have them installed, you can do a full file dump as well as other fun things like editing the registry.

http://msdn.microsoft.com/en-us/library/ms228708 (http://msdn.microsoft.com/en-us/library/ms228708)
http://msdn.microsoft.com/en-us/library/ms180714 (http://msdn.microsoft.com/en-us/library/ms180714)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nitroxide on October 27, 2013, 10:09:51 am
So, I've been off this for a while, working on other stuff or enjoying the weekend :), but I've been following the progress.

Now, late night I've done some work on the magic menu stuff. The function that gets called when the magic key trigger happens is found in facet_ui_qml (search "2hiddenMenuRequested()").

Reading about i3's gui.exe made me dig-up a bit and I've found this in "ui_remove_uicore_gui.rsc":

.appl entry
.appl.startup entry
.appl.startup.remove entry
.appl.startup.remove.0 index
.appl.startup.remove.0.name text "Gui.exe"
.appl.startup.remove.1 index
.appl.startup.remove.1.name text "uicore.exe"



I also know they are active running processes just by looking at "restartapp.bat":

set PATH=\windows;\FlashBFS\system\;
rset .watchdog.enable false
rset .services.log.active false
ps -k uicore
ps -k Gui
ps -k Prod
ps -k prod
ps -k MediaServer
ps -k appcore
ps -k AppServices
ps -k Resmon
ps -k Bit
ps -k syslog
ps -k Cam
ps -k cam
ps -k geni
ps -k dig
ps -k Dig
ps -k watch
ps -k Watch
ps -k RTP
ps -k fwa
ps -k progress
ps -k Med
delay 10
start appcore
delay 1
start prodapp


Sooo, it seems like someone learnt his lesson from i3 (at least partially :P) taking precautions against hacking E4 "i3 style";D. Now, if Mike or anybody elese having an Ex can retrieve those files from the camera (I'm not sure yet where they're hidden or how they're loaded) then simply dissasembling gui.exe will probably easily solve this! (I took a look at gui.exe from iX firmware - it's indeed a piece of cake to understand as IDA decompiles it completely)

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 27, 2013, 10:16:45 am
More snippets :
If you are buying an FFC cable, get one at least 200mm long, as that is long enough to be able to fit it permanently and route it down to be accessible as required from the battery compartment. Just make sure the exposed ends can;t short on the metal base when folded away.

Re. the rndis.rsc file :
Seems like the default behaviour if this file is not present, or the CRC is wrong is UVC and MSD
It does check the CRC in the file, which is why setting it to  RNDIS_UVC_MSD didn't work.

While playing with the rndis version of the file, something interesting happened  when I plugged the USB in- I saw some 'configuring' messages appear on my Windows icon bar, and then a new icon appeared (presumably something the Flir drivers installed).
This creates a drive which can access the user disk area, so sort-of equivalent to MSD, apart from having to have the RNDIS driver installed on the PC. My guess is it's probably just a wrapper for an FTP client

It would be really handy if someone could figure out the CRC algorithm on the files - I think this is the true key to opening many other goodies

By playing with the rndis.rsc file, I have established that the CRC does apply to comments, blank lines etc. so looks like a binary check, however adding stuff on the line after after the CRC does not break it, so it's probably CRCing only up until it sees the #CRC32.
Adding stuff between the last digit of the CRC and the newline does break it

There are plenty of sample files in the firmware .cab



Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 27, 2013, 10:23:08 am
More from my anonymous i7 contact, who whishes to be known as Zorro  ;)

My i7 actually had the debug tools installed
already, but they were an older/crippled version? So I replaced them
and it worked fine. Also installing the IDA remote debugger for
windows CE helped me learn a lot about the system. For example: on the
i7, if you set .version.hw.det_board.article it looks like you can
enable 30 fps. But you need to do it at startup through the config
files, and I don't know how to fix the checksum on those yet.

Just remember that when you run conmanclient2.exe,
you need to use "start conmanclient2.exe", otherwise you will just
leave your terminal hanging.


Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nilock2222 on October 27, 2013, 11:06:07 am

It would be really handy if someone could figure out the CRC algorithm on the files - I think this is the true key to opening many other goodies


Looks like it is just a standard 32 bit CRC like used in the ZIP format. Here's a short python script to calculate it for a file:

Code: [Select]
import sys
import zlib
with open(sys.argv[1], 'r') as fp:
    crc = zlib.crc32(fp.read()) & 0xffffffff
    print '0x%08x' % crc
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 27, 2013, 11:17:28 am
Possibly important Update
 I now suspect the CRC in the config.cfg file may be specific to the unit serial number, so the serial-only hack method may not work on other people's units.
Zorro thinks that files with CRC01 are related to the serial number, possibly with a RIPEMD160 derivative  whereas ones with CRC32 are a generic CRC.

If this is the case, then instead of using my hack files as-is, you will need to generate your own version of config.cfg by entering service mode (RNDIS + web interface) , and pulling your own config.cnf out of \Temp\appcore.d and copying into the \flashifs\hack directory.

A quick look suggests CRC32 is used for standard files (e.g. in the FW update) and CRC01 for files installed/generated in a particular unit, These files also have a #ID line containing the serial number.

One interesting thing I notice is the config file in the "service" dir doesn't have a CRC, so I'm wondering if part of the "Enter service mode" function takes this file as a template and generates a config file from it. If this is the case then There could be some interesting possibilities by editing this template file.
In fact, the only difference I can see between the "template" and the version in temp is the addition of the ID and CRC, so maybe we have a built-in CRC generation mechanism....
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 27, 2013, 11:18:25 am

It would be really handy if someone could figure out the CRC algorithm on the files - I think this is the true key to opening many other goodies


Looks like it is just a standard 32 bit CRC like used in the ZIP format. Here's a short python script to calculate it for a file:

Code: [Select]
import sys
import zlib
with open(sys.argv[1], 'r') as fp:
    crc = zlib.crc32(fp.read()) & 0xffffffff
    print '0x%08x' % crc
Have you checked this with any of the files?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nilock2222 on October 27, 2013, 11:26:52 am
Have you checked this with any of the files?

Yep, I tried it on several of the .rsc files. Just have to delete the existing CRC line before using.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nitroxide on October 27, 2013, 11:32:53 am
Lol, beat me to it. Just now I was previewing the post  :-DD
Just make sure to also delete the CRLF after last data line and it works! I've used: http://www34.brinkster.com/dizzyk/download/CheckCRC.zip (http://www34.brinkster.com/dizzyk/download/CheckCRC.zip)



Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 27, 2013, 11:47:52 am
Too tired to experiment now, but if it turns out that service mode entry can be used as a way to put the unit-specific sum on a config file, there is likely to be much more fun to be had.... I have sat in console mode watching files appearing in \temp  as service mode chugs away...

BTW one other new feature I noticed in service mode, is the extra 2 palette options aren't just different colours but  "blue when colder" and "red when hotter" than a value which can be set using the  up/down arrows.

BTW is anyone else here actually playing with an E4, or is everyone waiting to see if I manage to brick mine..?

For some reason I keep getting this image in my mind of a bunch of Flir people watching this thread and feeling as if their child is being ripped to pieces by a pack of wolves... :'(

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nitroxide on October 27, 2013, 11:49:47 am
Replacing ui_remove_uicore_gui.rsc with the attached one (modded + calc chksum) should have the effect of skipping the removing of gui.exe at start-up (maybe cold start is needed?). If so, the gui.exe could be retrieved for dissasembly and finding of magic key combination.

Mike, could you try?

I'm off to sleep now.  ;)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 27, 2013, 11:51:40 am
Zorro says he hacked his i3 to an i7 in exactly the same way as  the E4 - rndis to do service mode, copy config files, modify applaunch.dat
Go for it!


Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 27, 2013, 12:22:29 pm
something that I have been wondering about is the role of the eeprom. Especially seeing how the resolution bytes get changed when entering service mode, and how my earlier changes got mysteriously reverted.  Must do some I2C analysis traces to see what happens when service mode gets enabled.
I have a suspicion that it may be that it is only used as a simple way to communicate some configuration info between the main/service app and the bootloader, or maybe even read by the FPGA directly before the filesystem gets going.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 27, 2013, 12:37:53 pm


I also know they are active running processes just by looking at "restartapp.bat":

set PATH=\windows;\FlashBFS\system\;
rset .watchdog.enable false
rset .services.log.active false
ps -k uicore
ps -k Gui


I don't think the presence of those in restartapp.bat means much. Looking at what ps says when the main app is running, most of the ones listed are NOT running. ps displays a message when any task is terminated (e.g. using stopapp), and you only get a few showing this when you stop the app.
 I suspect these being in the batch files  are just  as a precautionary 'clean-up' left over from debugging or old versions. The fact that it has upper and lower case versions reinforces this. 
I'm not sure there is a gui.exe in the E4 - if there was, it would probably be in the firmware .cab
I think the GUI is mostly done by the stuff named "Facet" - I think someone has previously pointed this out.
Might be worth a look at an i3 firmware file if there is one to compare.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 27, 2013, 08:29:05 pm
This version of rndis.rsc enables all USB modes, however The Flir utility seems to get things in a knot - I think it tries to disable MSD to prevent clashes with its own drive letter, and things get into a bit of a mess, and ending up with the user file partition not getting mounted. To fix I had to close the Flir util, force it to unhacked mode by booting with USB in and swap the rndis file back. :phew:

 BTW the utility that gives the virtual drive is Program Files\FLIR Systems\FLIR Device Drivers\FLIR T3Srv\syx86\t3mon.exe
Quote
#
# USB mode MSD
#
.system entry
.system.usbmode text "RNDIS_UVC_MSD"
# CRC32 A18F2E3B

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 27, 2013, 09:19:07 pm
My hunch was right - adding stuff to
\flashfs\system\service\appcore.d\config.d\conf.cfg
DOES get baked into the checksummed version created by service mode entry, so for example adding
Quote
.caps.config.ui entry
.caps.config.ui.fusion entry
.caps.config.ui.fusion.PIP entry
.caps.config.ui.fusion.PIP.enabled bool true
to the end of the file makes PIP display mode work once you are in service mode, however you get an error message onscreen in hacked reboot - it still works but there's a menu in the way and the serial console doesn't work.
However MSD is still there so you can change it back.  :phew:
But replacing the previous conf.cnf in \hack still gives the error... hmmmm

Incidentally one advantage of using RNDIS and the FLIR virtual drive over MSD is you can take pics and upload them immediately - MSD locks out taking pics when connected to USB.

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 27, 2013, 10:16:41 pm
Not sure what happenned there - could be it saw the backup copy I'd made of the conf template file in \service. Unfortunately I forgot to make a copy of the CRC'd PIP config file so have to start again, however I've found some more out about the whole config & resource thing...

.rsc files in factory.d folders have CRC32

It looks at any & all files in the folder - e.g. renaming the file to set USB to RNDIS mode seems to still work

.cfg files in config.d folders have CRC01 , and it also appears to look at any and all files are looked at.

Items in these files get copied into the resource tree, so if there are items that can do fun things, they can probably be done as additional files instead of editing existing ones.

The question is can you add things like PIP and other goodies using a CRC32'd .rsc file...

I've modified the applaunch.dat to make it easier to play, so it will copy anything in config and factory folders
Quote
progressapp -f \flashbfs\system\bootlogo.bmp -g flashbfs\system\bocmd /c otlogo_
legal.bmp -d
# Start command shell on the RS-232 port
cmd /R
# Register a default user
defaultusr
cmd /C md \temp\appcore.d\
cmd /C md \temp\appcore.d\config.d
cmd /C md \temp\appcore.d\factory.d
cmd /C copy \flashifs\hack\__highres.cnf \temp
cmd /C copy \flashifs\hack\config\*.cfg \temp\appcore.d\config.d
cmd /C copy \flashifs\hack\factory\*.rsc \temp\appcore.d\factory.d
# Start appcore. Appcore starts other necessary processes
appcore




Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 27, 2013, 11:46:59 pm
OK so it looks like service mode can be used as a CRC01 stamping tool ;D

1) Copy your modified .cfg files to be stamped (without any checksum) into \flashfs\system\service\appcore.d\config.d\
2) Start service mode via web interface
3) Using serial or telnet console ( no need to wait for service mode restart) ,
copy the files from  \temp\appcore.d\config.d\*.*   to your user flash \hack dir
4) Delete the files you put in \flashfs\system\service\appcore.d\config.d\
(not sure if these are what caused problems before, but better be safe as it was a fiddle to recover)
Make sure the original conf.cfg is stil there.

You now have some CRC'd .cfg files in \hack, which you can try putting in your hack\crc folder to see what they do on the next cold boot.
Note it is not beyond doubt that some resource hacks might cause crashyness if you create resources that bork anything that runs beore applaunch,dat and progressapp (dunno if there are) , however it should in principle be recoverable by starting in E4 mode by cold booting with USB plugged in. Probably. YYMV.

Using this method to create a CRC'd PIP .cfg file from this
Quote
#
# Generated at CONFIG_DATE CONFIG_TIME
#
.caps.config.ui entry
.caps.config.ui.fusion entry
.caps.config.ui.fusion.PIP entry
.caps.config.ui.fusion.PIP.enabled bool true
.caps.hw entry

 the PIP display mode now works.  8)

I have tried putting a CRC32 on these files but it doesn;t work. CRC32 should for for .rsc files that go in the factory directory, but not sure if you can do anything useful other than change USB mode.
Detailed analysis of the resource attributes shown by rls -lll may give cluse about which reesources can be changed by which method.

now what else can we enable.....? Must read that Ex manual to see what other features the E8 adds...

Just to reiterate - cfg files with CRC01 are almost certainly  unit-specific, so need to be generated on the actual unit being hacked. 
As & when we find the hidden menu, this will all still be  possible without opening, over the RNDIS  connection. The only thing that the serial link is currently essential for is to enable USB RNDIS.

Incidentally, the first thing you should do before any other hacking, as soon as you have RNDIS running is make a copy of everything in \flashfs as this is all put on at the factory and not easily replaceable,

You can do this at the console by copying to the user partition but it's a pain as there are many directories.
I've not yet managed to get any FTP client other than Windows comamnd-line FTP to work ( have tried FTPsurfer and WinSCP)

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Monkeh on October 28, 2013, 12:03:35 am
Try Filezilla as an FTP client. Not a clue if it'll work, but nice client anyway.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: amyk on October 28, 2013, 12:27:52 am
Windows' FTP client uses active mode by default, whereas most others use passive - maybe their FTP server only works in active mode.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: equinoxe on October 28, 2013, 12:29:02 am
Windows' FTP client uses active mode by default, whereas most others use passive - maybe their FTP server only works in active mode.

+1
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Psi on October 28, 2013, 12:33:28 am
it wouldn't surprise me if they left passive mode code & commands out of a embedded development ftp server
It's not like you're ever going to have NAT between the TIC and the PC.

But i expect Mike probably tried passive/active already, it's really the first things you check whenever FTP doesn't work.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 28, 2013, 03:32:34 am
it wouldn't surprise me if they left passive mode code & commands out of a embedded development ftp server
It's not like you're ever going to have NAT between the TIC and the PC.

But i expect Mike probably tried passive/active already, it's really the first things you check whenever FTP doesn't work.
Nope - don't know much about networky stuff, I do recall a few years ago needing to use passive mode for something.
Actually the Flir A310 Tech note document recommends filezilla - just tried it an seems to work fine ( and appears to be using passive mode).
 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 28, 2013, 04:00:15 am
Looks like Marketing went through a few name changes...
Quote
# Default calib for Ex Camera a.k.a. Astra a.k.a. Z3
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on October 28, 2013, 04:18:45 am
Quote
BTW is anyone else here actually playing with an E4, or is everyone waiting to see if I manage to brick mine..?
.... as I am on vacation it will have to wait until next week - I will then hack mine, hopefully without bricking. But I know - I will check in here at least once a days to see any Progress.

Mike if you need any files or eeprom file from my E4 then (might be helpful for comparing, as you said some CRC might be serial # related), just send me a PM and I can send you this stuff together with my serial.
OK need to log out - wife is ranting about me sitting at the computer during vacation  ;D

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ixfd64 on October 28, 2013, 04:44:55 am
Looks like Marketing went through a few name changes...
Quote
# Default calib for Ex Camera a.k.a. Astra a.k.a. Z3

I think they're the internal code names.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: PA0PBZ on October 28, 2013, 04:53:56 am
I think they're the internal code names.

They of course have the problem of multiple products with the same hardware, so they can't call an E4 by it's name, and Ex just isn't nice enough.
In the software this model range is referred to as Z3, I'm not sure about Astra but there is a nice picture in the web folder called Z3_Astra:
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ixfd64 on October 28, 2013, 06:04:39 am
It could be the code name for the entire product line, kind of like how Haswell is the code name for Intel's latest generation of chips.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 28, 2013, 06:54:33 am
I've had a good look through the UI template files, and I'm fairly sure there isn't much more functionality to be had.
The manual shows 2 different box sizes for PiP, but the UI toolbar template only shows one.

There are resource keys apparently related to extra functions, but I strongly suspect these may not be implemented in the code and/or need buttons or hardware that aren't present.

As the FPGA will be specific to this model (I assume Ex0 series have significantly different hardware), I think it's reasonable to assume the 9Hz framerate is baked into the FPGA as there would be no reason for it not to be.

So I'm probably not going to spend much more time on this for the moment, and will wait until looking at doing a definitive file package and batch files to ease installation until someone else has confirmed it all works.

Things that still need looking at to make things easier :
1) Find how to get to the hidden menu
2) Figure out the CRC01 method - if we can do this it will simplify the hack process, as you should be able to just add a CRC for your serial number and replace one .cfg file to make it an E8 without needing to use service mode, and not have the minor issues of running in service mode. (Someone is already working on this with my files.)

I will do some FFC breakouts next time I get some PCBs done, which will be in the next couple of weeks - PM me if interested.

All the info is here, and anyone who's been following closely should be able to work it out - I've prepared a step-by-step guide and file set which I will test on my unit, but will wait for someone else to proofread and test it on another unit before publishing - please PM me.



Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nitroxide on October 28, 2013, 08:25:48 am
Maybe this is a bit far-fetched but could someone try the following key combinations and see if they have any effect (enabling service settings menu or other functionality?) - I really don't know at what point during program execution and for how long...:
- Option 1: Power Button + Image Archive Button  (pressed together and held?)
- Option 2: Image Archive Button + Cancel Button (pressed together and held?)
- Option 3: Left Joystick Button + Right Joystick Button (pressed together and held?)

I saw these combos defined in bt.exe (handles key press emulation) and I think there might be some functionality tied to them, otherwise I don't see the point of having them specifically defined.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 28, 2013, 08:54:34 am
Maybe this is a bit far-fetched but could someone try the following key combinations and see if they have any effect (enabling service settings menu or other functionality?) - I really don't know at what point during program execution and for how long...:
- Option 1: Power Button + Image Archive Button  (pressed together and held?)
- Option 2: Image Archive Button + Cancel Button (pressed together and held?)
- Option 3: Left Joystick Button + Right Joystick Button (pressed together and held?)

I saw these combos defined in bt.exe (handles key press emulation) and I think there might be some functionality tied to them, otherwise I don't see the point of having them specifically defined.
Bear in mind bt.exe probably has functionality for other models
left+right in charge mode shows charge stats.
power + any other buttons just does powerup/down as power button, at least a long press, is probably a hardware power-manager thing
No obvious effect from others
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 28, 2013, 09:04:13 am
OK just spent the last 2hrs testing my hack files and batchfiles & all OK.
Then I was sent some code to calculate the CRC01, which should make it a lot simpler. Too tired to play now  & work to get done so may be a day or two...
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: dustout on October 28, 2013, 09:59:53 am
I was finally able to get into the web interface on the i3.  I'm not completely sure but it seemed like plugging the unit into power jump-started things.  The battery was about dead so maybe it spins down those features when low on power / unplugged?

Activating service mode (with user / pass: flir / 3vlig ) did indeed increase resolution.  The larger field of view is absolutely wonderful too.  Much easier to use for short ranges.  Now to get it to stick past reboots... :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mamalala on October 28, 2013, 10:21:22 am
While i'm not in the market for any type of TIC, i just wanted to say kudos to Mike and others for spending time on hacking this thing. Great stuff going on here! Brings back some memories when i hacked some overpowered remote-control (Betty) that uses an LPC2220 ARM based chip. Went through all that stuff with IDA-Pro, etc. Too bad that i know absolutely nothing about WinCE internals (or any other Win internals, for that matter), so i guess i'm not of much help here anyways.

Keep up the good work. Hacking stuff is just fun!

Greetings,

Chris
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 28, 2013, 10:25:54 am
Too bad that i know absolutely nothing about WinCE internals (or any other Win internals, for that matter),
Neither did I before this.... !
Very impressed with what IDA can do - many years ago I spent a lot of time writing disassemblers for many different MCUs and doing manual tracing and cross-referencing with telephone-directory sized  disassembly printouts.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: olsenn on October 28, 2013, 10:26:10 am
So what is the current state of the E4 --> E8 hack?

             Is it purely a software hack (no opening the case required)?
             Are all functions of the E8 available to the E4 (is the hardware between them identical like the DS1052/DS1102)?
             Does it stick on reboot?
             Any bugs or other info worth mentioning?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 28, 2013, 10:34:10 am
So what is the current state of the E4 --> E8 hack?

             Is it purely a software hack (no opening the case required)?
             Are all functions of the E8 available to the E4 (is the hardware between them identical like the DS1052/DS1102)?
             Does it stick on reboot?
             Any bugs or other info worth mentioning?

You need to open the case, but only the first 2 screws and a lightly stuck fascia. No warranty seals on mine.
If someone finds the hidden menu, it will be doable without opening.
All E8 functionality and resolution as far as I can see (I think Ex manual doesn't quite reflect current firmware - only difference is 1 or 2 picture-in-picture sizes).
Only one very minor issue in that the USB must not be plugged in when you cold boot (battery  insert), otherwise it will revert to E4, but only until the next cold boot so not a problem.
 
We don't currently know if the E6/8 has a bigger lens - the spec on E6 and E8 lists a higher sensitivity, which may be explained by this.

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 28, 2013, 10:21:30 pm
Dave has likely been watching developments. If I were FLIR I would have been doing the same. It may come to pass that FLIR advise the agent to not supply a 'sample' for review if such would aid the hacking of an E4 in any way, even without opening it. I can't say I blame them  ;)

Mike and the other Forum members working on this 'challenge' have done sterling work. I do not pretend to understand the detail of what they have done with Win CE, but it has been fascinating all the same.

I am left bemused that the manufacturer chose to leave so much plain text commented  information in the firmware, detailing what the function of the various segments was. Understandable during development but not needed for the final release. I suspect FLIR will have learnt some valuable lessons from this investigation as well. They are a mature company, yet they did not take protection of their firmware very seriously at all. They obviously did not count on Mike and others taking a close interest in their product. I suspect the relatively 'open' firmware writing style is replicated across many of their new products.

An excellent example of complacency on the part of the software development team.

This has been/is a most educational investigation for which I thank Mike and the others who are assisting him. It would be interesting to hear Dave's comments on the matter, as with the Rigol Hack.

Sadly, FLIR may learn from this, and when they release the improved firmware with more keypad functionality, the process may need to be repeated to avoid a hard 'reset' to E4 functionality. 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: amyk on October 28, 2013, 11:27:09 pm
They obviously did not count on Mike and others taking a close interest in their product. I suspect the relatively 'open' firmware writing style is replicated across many of their new products.
They figure that there are going to be very, very few people willing to take apart and fiddle with such a device, not only because of its price, but because of warranty and their usual customer demographic (i.e. people who don't know anything about how embedded systems work, but are "experts" at using TICs).

They could lock down the firmware even more, but that would probably just stifle sales back to their old value (and at extra cost to them to implement these changes), or even lock down the sensor somehow (and probably at even more cost to them) -- in any case, using the raw sensor directly is likely not above Mike's capabilities... (http://www.electricstuff.co.uk/ektapro.html)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 29, 2013, 12:08:00 am
Indeed, very true.

I have used this technology for many years but would never tear down a $40K camera ! I would have lost my job.

Affordability has brought curiosity with it  ;)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 29, 2013, 12:21:00 am
They obviously did not count on Mike and others taking a close interest in their product. I suspect the relatively 'open' firmware writing style is replicated across many of their new products.
They figure that there are going to be very, very few people willing to take apart and fiddle with such a device, not only because of its price, but because of warranty and their usual customer demographic (i.e. people who don't know anything about how embedded systems work, but are "experts" at using TICs).

They could lock down the firmware even more, but that would probably just stifle sales back to their old value (and at extra cost to them to implement these changes), or even lock down the sensor somehow (and probably at even more cost to them) -- in any case, using the raw sensor directly is likely not above Mike's capabilities... (http://www.electricstuff.co.uk/ektapro.html)
There are also a lot of other issues like their manufacturing process, QA, calibration etc. that come into it as well - the cost of making software changes increases sunstantially as a product moves  from development to production.

Although not many people would be willing to open up a £800 product, if it is possible without opening, that changes, and bear in mind with the current software, you could decide to not make any changes to the internal files and just run it in service mode when high-res is needed, as it will stay there until the battery is taken out or it goes very flat - just putting it in sleep mode keeps it in service mode. The only thing you don't get that way is PiP mode.

There is clearly some very heavy profiteering in the 320x240 market segment at the moment, and relatively few players (many others are badged Fluke/Flir products). It only takes one to jump before the others all follow, but any comapnies that can't match the lower price for high res will be dead in the water.
However in the meantime, the low-end TIC market has to be very appealing as the volumes are potentially much higher when products get  within reach for people who wouldn't normally consider buying a TIC, so if your product has a 'hidden' advantage over your competition then this has to be good for sales.
Of course there is also the fact that people love to get a bargain by subverting the system- the Rigol effect....
The question is whether Flir are sufficiently enligtened to realise it. Time will tell.

Something else I wonder about is whether suppliers of sensors maybe have some dodgy agreements in place to supply at reduced price conditional on the end products not being used at full res. 


Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Psi on October 29, 2013, 12:22:11 am
Companies only bother to do anything if
- It's required by law
 or
- It makes more money, or prevents money from being lost

The hack will boost E4 sales but will have little to no effect on E5+ sales.
(It will be engineers/hackers/makers who add to E4 sales and these people wouldn't have bought a better model otherwise)
So from a money standpoint there's no reason for Flir to stop the hack in future firmware, it would make more money to leave it.

The legal aspect however is much more of an issue.
If people can buy and modify the E4 unit from something that can be exported into something that cannot (or is more tightly controlled like 60fps) then Flir will be worried about getting in trouble with the US government.
As such, this will be the driving factor for stopping the hack on future firmware.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 29, 2013, 12:24:22 am
Pandoras box may have been opened  >:D   :scared:
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 29, 2013, 12:24:54 am
Quote
in any case, using the raw sensor directly is likely not above Mike's capabilities...
At some point I will definitely take a look at the raw output, if only out of curiosity about noise etc. Probably not for a while though - too busy!

If someone wanted to add a TIC to a quadcopter or RC aircraft, buying this, stripping out all the surplus weight and tapping the full-res output would be a pretty viable solution and relatively low-cost. 
Converting the 60FPS raw stream to composite video would be not very hard at all - a small FPGA and a DAC
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 29, 2013, 12:28:43 am
Maybe, but everything I have read on TIC design indicates that a lot of correction related maths is needed to form a decent image. It appears that the FPA is quite a badly behaved sensor that needs taming before its data is truly usable ? No inside knowledge on this though.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 29, 2013, 12:28:54 am
If people can buy and modify the E4 unit from something that can be exported into something that cannot (or is more tightly controlled like 60fps) then Flir will be worried about getting in trouble with the US government.
As such, this will be the driving factor for stopping the hack on future firmware.
I have no reason to believe that >9fps is possible with a hack (though you may get a little more with overclocking) - As the downsampling appears to happen in the FPGA there is no reason not to bake the limit into the FPGA. Whether they have or not is an interesting question - not impossible that they use the same FPGA code across a wide range of models.
Of course what we don't know is how different the hardware is from the Ex0 series...
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Psi on October 29, 2013, 12:29:51 am
If someone wanted to add a TIC to a quadcopter or RC aircraft, buying this, stripping out all the surplus weight and tapping the full-res output would be a pretty viable solution and relatively low-cost. 

RC drone with thermal camera could loosely be classed as using the camera as part of a weapon system.

It is however, an awesome idea :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 29, 2013, 12:31:54 am
Its already been done several times using a Tau camera core !

http://www.buzzflyer.co.uk/quadcopter-Flir-Thermal-Imaging-Camera.asp (http://www.buzzflyer.co.uk/quadcopter-Flir-Thermal-Imaging-Camera.asp)

http://bestquadcopter.com/flying-fpv-night-flir-infrared-camera/ (http://bestquadcopter.com/flying-fpv-night-flir-infrared-camera/)

Direct You Tube link

RFTC: Flying FPV at Night with a FLIR Thermal Imaging Camera (http://www.youtube.com/watch?v=wqlptPhFmk0#ws)

Thermal Imaging Camera with Quadcopter (http://www.youtube.com/watch?v=Ml6Ftqbwqso#)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 29, 2013, 12:35:02 am
Maybe, but everything I have read on TIC design indicates that a lot of correction related maths is needed to form a decent image. It appears that the FPA is quite a badly behaved sensor that needs taming before its data is truly usable ? No inside knowledge on this though.
Probably - there are a couple of cal files that look like per-pixel data.
I'd expect at least a gain per pixel, perhaps linearitycurves, and maybe corrections for shutter-closed offsets over different temp ranges.
And bad pixel concealment.
Which is why I'm curious to look at the raw output. Bear in mind that a lot of apps don't need linearity/accuracy and high framerate at the same time.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Psi on October 29, 2013, 12:35:30 am
I have no reason to believe that >9fps is possible with a hack (though you may get a little more with overclocking) - As the downsampling appears to happen in the FPGA there is no reason not to bake the limit into the FPGA. Whether they have or not is an interesting question - not impossible that they use the same FPGA code across a wide range of models.
Of course what we don't know is how different the hardware is from the Ex0 series...

Yeah, i guess the issue is more about the raw 60hz data being available on a 9Hz unit, rather than the resolution hack.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nowlan on October 29, 2013, 12:47:06 am
If someone wanted to add a TIC to a quadcopter or RC aircraft, buying this, stripping out all the surplus weight and tapping the full-res output would be a pretty viable solution and relatively low-cost. 

I found this page earlier.
http://diydrones.com/profiles/blogs/tiny-thermal-cameras-for-drones (http://diydrones.com/profiles/blogs/tiny-thermal-cameras-for-drones)
http://www.drsinfrared.com/ModulesDetectors/UncooledCameraModules.aspx (http://www.drsinfrared.com/ModulesDetectors/UncooledCameraModules.aspx)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 29, 2013, 01:29:29 am
Of course there is another reason that a manufacturer may want to stop a hack - if someone was reselling hacked units, either with original  branding or rebranded (might be tricky to change the boot-up logos to rebrand though).

And no, it won't be me...!
Wouldn't surprise me to see the odd on ebay though, maybe more likely i3's
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Hypernova on October 29, 2013, 02:13:11 am
The question is whether Flir are sufficiently enligtened to realise it. Time will tell.

I wouldn't count on it, cooperate management types are by definition incompetent.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 29, 2013, 02:14:21 am
DRS makes nice equipment -- curious why it's not ITAR.
Anything over 9fps made in USA is covered by ITAR, and similar regs in other countries.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ixfd64 on October 29, 2013, 03:25:34 am
I wonder how hard it would be to write our own custom firmware.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: IanB on October 29, 2013, 03:51:20 am
If time averaged sampling is used to smooth out noise, then higher frame rates are going to be harder to achieve without upping the noise level.

One possibility is to have a bigger lens with a larger aperture. This would allow more radiation to reach the sensor in a given time, permitting a faster frame rate without compromising the S/N ratio on the sensor.

At some point performance increases will rely on physical design parameters and not simply on electronics.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: 0xdeadbeef on October 29, 2013, 03:59:26 am
Yeah, but nobody says you'd need to use the full 60Hz. When sample twice, three or four times to reduce the noise by averaging, you'd still come out with more than 9Hz.
Besides, you could implement a moving average filter even with 60Hz and trade in noise for motion blur.
Anyway, Mike seems to assume that the complete signal/image processing is done in the FPGA/ASIC, so this would make it much harder if not impossible to change the 9Hz anyway.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mamalala on October 29, 2013, 06:30:33 am
Too bad that i know absolutely nothing about WinCE internals (or any other Win internals, for that matter),
Neither did I before this.... !
Very impressed with what IDA can do - many years ago I spent a lot of time writing disassemblers for many different MCUs and doing manual tracing and cross-referencing with telephone-directory sized  disassembly printouts.

Indeed, IDA is a great tool. i guess you already found the button to give you a graphical "flow diagram" style view of the code, where the boxes contain the code fragments?

Greetings,

Chris
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: olsenn on October 29, 2013, 06:33:47 am
Quote
Anything over 9fps made in USA is covered by ITAR, and similar regs in other countries.

Perhaps I am wrong, but I was under the impression that ITAR only governs the export of government furnished technical data, and not technology itself; that is to say that if an engineer creates a thermal camera that operates at higher refresh rate than 9Hz, but does so without accessing ITAR schematics or white papers, then the device is itself not ITAR. Feel free to call BS on this one though
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mamalala on October 29, 2013, 06:35:46 am
I have no reason to believe that >9fps is possible with a hack (though you may get a little more with overclocking) - As the downsampling appears to happen in the FPGA there is no reason not to bake the limit into the FPGA. Whether they have or not is an interesting question - not impossible that they use the same FPGA code across a wide range of models.
Of course what we don't know is how different the hardware is from the Ex0 series...

Is the FPGA a flash/EEProm type, or does it use an external EEProm for the bitstream? Or is the bitsream uploaded from a file through the WinCE? If the latter, it may just be matter of getting the "right" bitstream file...

Greetings,

Chris
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 29, 2013, 07:34:54 am
Too bad that i know absolutely nothing about WinCE internals (or any other Win internals, for that matter),
Neither did I before this.... !
Very impressed with what IDA can do - many years ago I spent a lot of time writing disassemblers for many different MCUs and doing manual tracing and cross-referencing with telephone-directory sized  disassembly printouts.

Indeed, IDA is a great tool. i guess you already found the button to give you a graphical "flow diagram" style view of the code, where the boxes contain the code fragments?

Greetings,

Chris
I've not actually used it, just seen the listings for this and the x-ray. If I ever get something that needs some serious disassembly I'll probably buy it, as sometimes you need the flexibility to adjust options depending on what'd been found.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 29, 2013, 07:36:38 am
I have no reason to believe that >9fps is possible with a hack (though you may get a little more with overclocking) - As the downsampling appears to happen in the FPGA there is no reason not to bake the limit into the FPGA. Whether they have or not is an interesting question - not impossible that they use the same FPGA code across a wide range of models.
Of course what we don't know is how different the hardware is from the Ex0 series...

Is the FPGA a flash/EEProm type, or does it use an external EEProm for the bitstream? Or is the bitsream uploaded from a file through the WinCE? If the latter, it may just be matter of getting the "right" bitstream file...

Greetings,

Chris
It's RAM, loaded from a file on the WinCE filesystem. However it would be a lot of work to create a new one, even after a lot of effort just to work out the pinout- you'd probably need to risk sacrificing a unit to do it.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mamalala on October 29, 2013, 08:28:24 am
I have no reason to believe that >9fps is possible with a hack (though you may get a little more with overclocking) - As the downsampling appears to happen in the FPGA there is no reason not to bake the limit into the FPGA. Whether they have or not is an interesting question - not impossible that they use the same FPGA code across a wide range of models.
Of course what we don't know is how different the hardware is from the Ex0 series...

Is the FPGA a flash/EEProm type, or does it use an external EEProm for the bitstream? Or is the bitsream uploaded from a file through the WinCE? If the latter, it may just be matter of getting the "right" bitstream file...

Greetings,

Chris
It's RAM, loaded from a file on the WinCE filesystem. However it would be a lot of work to create a new one, even after a lot of effort just to work out the pinout- you'd probably need to risk sacrificing a unit to do it.

Well, the idea was not so much about reimplementing it, but getting hold of one for the better models (unless even the higher models, sold inside the US, have the same limitations). There is a good chance that the signal connections itself are the same, i.e. based on the same circuitry, and just the bitstream is a different one depending on capabilities. Of course that would require to get hold of one in the first place ....

Greetings,

Chris

Edit: That reminds me about something that i was wondering for quite some time: is there anything like a disassembler for FPGA bitstreams? Maybe not something as sophisticated as IDA, but still? Or is the IP about what goes on inside an FPGA such a "mystery" that there is simply no way to produce such a tool?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ataradov on October 29, 2013, 08:35:36 am
Edit: That reminds me about something that i was wondering for quite some time: is there anything like a disassembler for FPGA bitstreams? Maybe not something as sophisticated as IDA, but still? Or is the IP about what goes on inside an FPGA such a "mystery" that there is simply no way to produce such a tool?
There were a couple projects trying to reverse-engineer bitstream format for Xilinx FPGAs. It was shut down by Xilinx lawyers almost immediately as it became public. It is still possible to find a PDF describing the effort, but referenced files are all gone from public view.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 29, 2013, 08:39:41 am
I have no reason to believe that >9fps is possible with a hack (though you may get a little more with overclocking) - As the downsampling appears to happen in the FPGA there is no reason not to bake the limit into the FPGA. Whether they have or not is an interesting question - not impossible that they use the same FPGA code across a wide range of models.
Of course what we don't know is how different the hardware is from the Ex0 series...

Is the FPGA a flash/EEProm type, or does it use an external EEProm for the bitstream? Or is the bitsream uploaded from a file through the WinCE? If the latter, it may just be matter of getting the "right" bitstream file...

Greetings,

Chris
It's RAM, loaded from a file on the WinCE filesystem. However it would be a lot of work to create a new one, even after a lot of effort just to work out the pinout- you'd probably need to risk sacrificing a unit to do it.

Well, the idea was not so much about reimplementing it, but getting hold of one for the better models (unless even the higher models, sold inside the US, have the same limitations). There is a good chance that the signal connections itself are the same, i.e. based on the same circuitry, and just the bitstream is a different one depending on capabilities. Of course that would require to get hold of one in the first place ....
]The problem is that (if they have any sense) the pinout will be adapted to suit the PCB of the product - even a single pin swap would mean a very different bitstream. Add to that this product has the visible camera stuff handled by the FPGA.

It would however be interesting to see what signals & voltages are used to drive the sensor. It's a bit tricky to get at though - would need to make a riser board.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: PA0PBZ on October 29, 2013, 08:41:05 am
Code: [Select]
Ex  fpga.bin       FLIR....POLLUX......27-Jun-2013.............................,.......ASBB
Exx fpga_B2CO3.bin FLIR....MIRA........23-Aug-2013.............................8.......SLCO
Exx fpga_C4_55.bin FLIR....MIRA........26-Apr-2013.............................8.......SLCO


 :-//
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 29, 2013, 08:41:45 am
Quote
Anything over 9fps made in USA is covered by ITAR, and similar regs in other countries.

Perhaps I am wrong, but I was under the impression that ITAR only governs the export of government furnished technical data, and not technology itself; that is to say that if an engineer creates a thermal camera that operates at higher refresh rate than 9Hz, but does so without accessing ITAR schematics or white papers, then the device is itself not ITAR. Feel free to call BS on this one though
It covers movement of technical information and items, regardless of who does it.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 29, 2013, 08:43:38 am
Code: [Select]
Ex  fpga.bin       FLIR....POLLUX......27-Jun-2013.............................,.......ASBB
Exx fpga_B2CO3.bin FLIR....MIRA........23-Aug-2013.............................8.......SLCO
Exx fpga_C4_55.bin FLIR....MIRA........26-Apr-2013.............................8.......SLCO

:-//
..of course these files would be in firmware upgrade packages, but unless the PCB is identical they wouldn't be any use.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: PA0PBZ on October 29, 2013, 08:46:13 am
..of course these files would be in firmware upgrade packages, but unless the PCB is identical they wouldn't be any use.

Identical PCB, identical FPGA, Identical IR sensor... No chance I'd say
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mamalala on October 29, 2013, 08:48:34 am
]The problem is that (if they have any sense) the pinout will be adapted to suit the PCB of the product - even a single pin swap would mean a very different bitstream. Add to that this product has the visible camera stuff handled by the FPGA.

It would however be interesting to see what signals & voltages are used to drive the sensor. It's a bit tricky to get at though - would need to make a riser board.

That's something i would not be so sure of. I have seen different products from the same manufacturer re-using circuit blocks. Sure, the actual layout was sometimes different, but the interconnections remained the same. of course none of that used FPGA's, but microcontrollers instead, but even those could have benefited from a slightly different pin usage depending on the layout. But instead they reused the same block, with the same interconnections. Of course i am just specualting here that FLIR does the same, so it may well be that i am completely wrong here.

Greetings,

Chris
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mamalala on October 29, 2013, 08:49:17 am
Edit: That reminds me about something that i was wondering for quite some time: is there anything like a disassembler for FPGA bitstreams? Maybe not something as sophisticated as IDA, but still? Or is the IP about what goes on inside an FPGA such a "mystery" that there is simply no way to produce such a tool?
There were a couple projects trying to reverse-engineer bitstream format for Xilinx FPGAs. It was shut down by Xilinx lawyers almost immediately as it became public. It is still possible to find a PDF describing the effort, but referenced files are all gone from public view.

Sadly, this doesn't surprise me in the least ;(

Greetings,

Chris
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 29, 2013, 09:49:50 am
I had a play with the TargetNoiseMk setting and it does appear to be added noise.
There is a small, but noticeable difference between default value of 135 and a low setting of 13
I can only assume it's to reduce banding and/or give an impression of sharpness
(These pics are with MSX, but low light so mostly thermal)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: M. András on October 29, 2013, 09:58:57 am
thats an absolute joke. its almost clear on the low setting image what are we looking at. the high well mobile phone camera quality
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 29, 2013, 10:18:18 am
EEEEEEK!  :scared: Adding noise = YUK !
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ataradov on October 29, 2013, 10:25:22 am
Adding noise before decimation (reduction of resolution) is a common technique.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 29, 2013, 10:27:50 am
I only work with the full unadulterated FPA resolution  :P

My cameras are an artificial noise free zone ! (I hope)

 :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tesla500 on October 29, 2013, 10:31:04 am
Adding noise before decimation (reduction of resolution) is a common technique.

What does this accomplish?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: M. András on October 29, 2013, 10:40:56 am
Adding noise before decimation (reduction of resolution) is a common technique.

What does this accomplish?
more sales in their higher software optioned models?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ataradov on October 29, 2013, 10:41:21 am
Let's say you have signal with a maximum just a bit below your lowest resolution level. It will show as a plain color showing lowest possible level. Now add a bit of white noise. Pixels that were just below the threshold are now part time above the threshold, so you have two discrete levels. Pixels that were way below the threshold will stay there with higher probability.

Decimation filter will average the noise, so it won't show as much in the final result.

This technique is also used to "increase" resolution of ADCs.

PS: Proper name of this technique is dithering. 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 29, 2013, 10:56:12 am
I now have a much simpler hack method that does not involve service mode, and does not modify any existing files on the camera. PM me if you have a camera and want to try.

It is fairly likely this may work on the i3 as well - not sure how similar the i series is to the E
 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tom66 on October 29, 2013, 10:57:02 am
Also known as supersampling. I'd imagine that your typical FPA produces enough noise that adding more isn't a big deal.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ixfd64 on October 29, 2013, 12:19:11 pm
I wonder if similar hacks can be applied to Fluke cameras.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: bean_dip on October 29, 2013, 12:56:56 pm
I now have a much simpler hack method that does not involve service mode, and does not modify any existing files on the camera. PM me if you have a camera and want to try.

It is fairly likely this may work on the i3 as well - not sure how similar the i series is to the E

So much respect! I can't wait until my FFC cable gets here...I got the shipping confirmation from DigiKey today and they charged sales tax which means it should be shipping from inside the state.  Here's hoping it will be waiting for me tomorrow when I get home from work!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on October 29, 2013, 01:48:18 pm
There were a couple projects trying to reverse-engineer bitstream format for Xilinx FPGAs. It was shut down by Xilinx lawyers almost immediately as it became public. It is still possible to find a PDF describing the effort, but referenced files are all gone from public view.
I take it debit from Jean-Baptiste Note on http://www.ulogic.org/ (http://www.ulogic.org/) was one of those projects? Looks like his debit project has found a new home (http://code.google.com/p/debit/). From what I can find it looks to be the same codebase. Checking the source clones might also yield nice new resources.

git clone https://code.google.com/p/debit/

You know you want to...


edit: die stupid url tag, die!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ataradov on October 29, 2013, 02:05:56 pm
I take it debit from Jean-Baptiste Note on http://www.ulogic.org/ (http://www.ulogic.org/) was one of those projects?
Yes, it was one of the projects. I found it when I was trying to do reverse-engineering myself. But seeing how lawyers are VERY active with cease and desist notices, I lost all interest. Completing and maintaining the project would be a lot of work, no reason to do it and know for sure that it will be shut down as soon as it gets any traction.

PS: Cloned it just in case :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Psi on October 29, 2013, 02:22:02 pm
i reckon the noise seting is just to make the image quallity lower than the better models.

Would need to check the value on a E8 to confirm
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on October 29, 2013, 02:28:50 pm
I wouldn't be surprised if the noise setting is a bit of both. A lower (but non-zero) amount of noise might actually improve the image quality, as per the dithering remarks. And a higher amount of noise might be used to artificially make the sensor in lower end models appear crappier than it is. ;)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: amyk on October 29, 2013, 04:41:12 pm
I wouldn't be surprised if the noise setting is a bit of both. A lower (but non-zero) amount of noise might actually improve the image quality, as per the dithering remarks. And a higher amount of noise might be used to artificially make the sensor in lower end models appear crappier than it is. ;)
Noticing how high Mike could turn up the noise from the E4's default, maybe they were thinking of making an E1 ~ E3 at some point.

Quote
Yes, it was one of the projects. I found it when I was trying to do reverse-engineering myself. But seeing how lawyers are VERY active with cease and desist notices, I lost all interest. Completing and maintaining the project would be a lot of work, no reason to do it and know for sure that it will be shut down as soon as it gets any traction.
The limited (public*) efforts to RE FPGAs is as you said, largely due to political/legal instead of technical issues; due to how the devices are constructed their bitstreams have a very regular format so it's rather trivial to figure out. Now if only someone does it anonymously and releases like Wikileaks... ;)

*because no doubt the Chinese have done it out a long time ago, and have just not shared their results, at least on the English side of the web, maybe for these legal reasons.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 29, 2013, 08:12:08 pm
I wouldn't be surprised if the noise setting is a bit of both. A lower (but non-zero) amount of noise might actually improve the image quality, as per the dithering remarks. And a higher amount of noise might be used to artificially make the sensor in lower end models appear crappier than it is. ;)
Noticing how high Mike could turn up the noise from the E4's default, maybe they were thinking of making an E1 ~ E3 at some point.

No - it's just a variable that can be set to stupid values.
Having used it some more, I think it's probably mainly to reduce visible banding on smooth gradients - this may be more noticeable at lower resolutions. Might be interesting to see if the E8 has a different setting.
I think a small amount of noise does give an illusion of more crispness - the noise-free version looks smooth but subjectively slightly less well focussed. I wonder if a factor is making a cheap lens look subjectively better.

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 29, 2013, 11:19:37 pm
Mike,

Here is the link to the cheaper Thermal Camera lenses that I mentioned previously. Maybe FLIR are using these in the lower end cameras ? Note that these lenss were first detailed in May 2009 and not the date shown on the articles. As such they could easily be in production now. Performance appears inferior to Germanium but in a low end TIC maybe that would not be such an issue.

http://www.gizmag.com/cheap-infrared-lenses-fraunhofer/23659/ (http://www.gizmag.com/cheap-infrared-lenses-fraunhofer/23659/)

http://www.en.iwm.fraunhofer.de/news/details/id/591/ (http://www.en.iwm.fraunhofer.de/news/details/id/591/)

As an insight into the crazy world of thermal camera optics, I just procured an 18mm, 45 Degree Germanium lens for my PM695. Its a large, multi-element, beast with very large lumps of Germanium in it of approx 60mm diamter. The price from FLIR and its agents is ...... over $7500  :scared:  I have seen them cheaper on the used market though. The Germanium lenses still appear to be a very expensive component in the TIC.

Fraser
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 30, 2013, 12:26:44 am
An interesting document on the new technolgy for cheap thermal camera lenses is to be found here:

http://www.lehigh.edu/~inimif/eciworkshop/25D_Zhang.pdf (http://www.lehigh.edu/~inimif/eciworkshop/25D_Zhang.pdf)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: olsenn on October 30, 2013, 01:54:20 am
When you say "cheap thermal camera lenses", do you mean the sensor as well, or just the lens? I'm assuming high-IR sensors aren't commonly found for cheap?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 30, 2013, 02:16:01 am
Sadly not.

It would appear that FLIR have managed to reduce the manufacturing cost of the FPA (sensor), but we are uncertain as to whether the lens assembly has also been cost reduced in some way. I have presented a cheaper thermal camera lens that may have been used with the E4 FPA.
 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: olsenn on October 30, 2013, 04:31:28 am
Quote
It would appear that FLIR have managed to reduce the manufacturing cost of the FPA (sensor), but we are uncertain as to whether the lens assembly has also been cost reduced in some way. I have presented a cheaper thermal camera lens that may have been used with the E4 FPA.

Flir reduced the manufacturing cost compared to what? You mean it's confirmed that the E4 has a different lens/sensor than the E8?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 30, 2013, 04:39:19 am
Hard to tell as the anti-reflection coatings mean you can't tell much about the material.  The lens is pretty small, and I think single element - it is a slightly unusual shape in that the front is concave. Small  ge lenses aren' t hugely expensive I found some prices for  Ge windows at £10 1-off  (http://www.crystran.co.uk/windows/germanium-windows), so volume prices for small lenses are likely to be in the low tens of pounds max. 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 30, 2013, 04:42:05 am
Quote
It would appear that FLIR have managed to reduce the manufacturing cost of the FPA (sensor), but we are uncertain as to whether the lens assembly has also been cost reduced in some way. I have presented a cheaper thermal camera lens that may have been used with the E4 FPA.

Flir reduced the manufacturing cost compared to what? You mean it's confirmed that the E4 has a different lens/sensor than the E8?
Compared to earlier devices. It is not currently known if the E8 has a bigger lens, but the better sensitivity spec suggests this may be the case.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 30, 2013, 06:25:32 am
My comparison of FPA cost was relative to the type of "full fat" FPA fitted in my industrial FLIR PM695 thermal cameras. As you will see from the pictures of the sensor in this post

http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-review/30/ (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-review/30/)

my FPA is encased in a sturdy vacuum envelope and mounted on a rigid bearer. Lots of Gold plating as well. Its a significant size and a monster when compared to the newer 'cut down' design that FLIR have in the E4. Remember, my FLIR cost $40,000 and not $1,000 so manufacturing costs have likely been trimmed dramatically, even when compared to more recent FLIR designs.


Some care is needed when considering the cost of a Germanium lens. A Germanium lens is manufactured from a single crystal of Germanium which, in itself, is a very expensive material. The 'blank' is then cut with a diamond profiler to create the correct shape. The shaped blank is then polished into a lens. To perform well, the lens is then coated with expensive anti reflective coatings that directly effect the transmission performance of the finished lens. This process is far more expensive and complex than making a simple flat Germanium windows.  Such are not diamond cut and not coated unless specified. Saying all that, I have bought 20mm GaAs and ZnSe lenses from China for only $30  :-// I assume they need a similar production process to Ge but I am not certain and I know the coatings are not the same as they were designed for CO2 laser use which is relatively narrow band use.

Mike's referenced url states GBP150 for a 13mm ZnSe lens  :o  ZnSe is supposed to be the cheaper option !

http://www.crystran.co.uk/lenses/zinc-selenide-positive-lenses/130mm-x-280-mm-fl-pcx (http://www.crystran.co.uk/lenses/zinc-selenide-positive-lenses/130mm-x-280-mm-fl-pcx)

http://www.crystran.co.uk/lenses/zinc-selenide-positive-lenses (http://www.crystran.co.uk/lenses/zinc-selenide-positive-lenses)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: AndyC_772 on October 30, 2013, 08:37:13 am
Mike (and anyone else with an E4):

How useful would you estimate this particular camera is for taking images of PCBs, in enough detail to identify which components are getting warm (with or without the benefit of your recent work)?

For example: last year I borrowed an E60, which has a manual focus lens, and not only was I able to pick out individual 0603 components, but I could also easily see which components were active at any particular time. It would have been a really useful tool for finding out how a board's power dissipation is distributed, or for tracking down failed components on a faulty card.

Shame it's about £6000, though, and there's no way I'd get value for money from it. But £800 for an E4 is far easier to justify.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 30, 2013, 08:48:25 am
Mike (and anyone else with an E4):

How useful would you estimate this particular camera is for taking images of PCBs, in enough detail to identify which components are getting warm (with or without the benefit of your recent work)?

Yes -
See pics on this post (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg316866/#msg316866)

The only issue at the moment is adjusting the lens for close-up focus -the lens can be adjusted without opening as it's only locked by the friction of the surrounding rubber, but it's a bit hard to grab hold of. 
 I am working on a tool to do this, as well as looking at using cheap laser cutter lenses
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tnt on October 30, 2013, 08:07:15 pm
After finding the CRC01 algorithm, I had a look at the hidden menu, but so far I didn't really find where it can be enabled ... I'll probably look a bit more into it once I get the camera but if I don't get a break through soon, I'll leave it to someone else ... the serial method doesn't seem too inconvenient, you just need to remove the face plate and nothing else.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nitroxide on October 30, 2013, 09:40:21 pm
After finding the CRC01 algorithm, I had a look at the hidden menu, but so far I didn't really find where it can be enabled ... I'll probably look a bit more into it once I get the camera but if I don't get a break through soon, I'll leave it to someone else ... the serial method doesn't seem too inconvenient, you just need to remove the face plate and nothing else.

If you use IDA, search for "2hiddenMenuRequested" in "facet_ui_qml.dll". You'll see that at the start of the sub_10078468 there's a compare with 0x10003; if it matches it enables the secret menu, otherwise it simply returns - I have no idea what that 0x10003 is...

I haven't found how and from where this "sub_10078468" is called but I'm sure that doing remote debugging on the actual device could teach us some more about it.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 30, 2013, 11:30:52 pm
After finding the CRC01 algorithm, I had a look at the hidden menu, but so far I didn't really find where it can be enabled ... I'll probably look a bit more into it once I get the camera but if I don't get a break through soon, I'll leave it to someone else ... the serial method doesn't seem too inconvenient, you just need to remove the face plate and nothing else.

If you use IDA, search for "2hiddenMenuRequested" in "facet_ui_qml.dll". You'll see that at the start of the sub_10078468 there's a compare with 0x10003; if it matches it enables the secret menu, otherwise it simply returns - I have no idea what that 0x10003 is...

I haven't found how and from where this "sub_10078468" is called but I'm sure that doing remote debugging on the actual device could teach us some more about it.

For this sort of thing it would be handy to have a utility that would search for a binary string in a whole folder of files to find cross-references between DLLs. .EXEs etc. - anyone know of a good one?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on October 30, 2013, 11:34:02 pm
For this sort of thing it would be handy to have a utility that would search for a binary string in a whole folder of files to find cross-references between DLLs. .EXEs etc. - anyone know of a good one?

grep?  :-//
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Psi on October 30, 2013, 11:35:48 pm
If I had designed the unit I would probably have made the service menu enable when you point the camera at a special service barcode/QRcode.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tnt on October 30, 2013, 11:36:01 pm
Looks to me like this function is used in a virtual table. If I had to guess I'd say the "KeyEvent" call back. R1 should be the QKeyEvent then and 0x10003 would be the key code ?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nitroxide on October 31, 2013, 12:46:12 am
Looks to me like this function is used in a virtual table. If I had to guess I'd say the "KeyEvent" call back. R1 should be the QKeyEvent then and 0x10003 would be the key code ?

thought about that but found no reference about 0x10003 being a key - from bt.exe dissasembly I've seen that the keycodes have much lower hex values
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tnt on October 31, 2013, 12:47:48 am
thought about that but found no reference about 0x10003 being a key - from bt.exe dissasembly I've seen that the keycodes have much lower hex values

Interesting ... Because looking at the XML in ui.d, there is some keys and value associated to them and they are much higher values ... ( like 16777269 = 0x1000035 )
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nitroxide on October 31, 2013, 12:53:37 am
Quote
Interesting ... Because looking at the XML in ui.d, there is some keys and value associated to them and they are much higher values ... ( like 16777269 = 0x1000035 )

hmm, haven't looked at those keys defined in "design_ui_z3.xml"
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: bookaboo on October 31, 2013, 03:50:03 am
Bullet has been bitten... E4 ordered.
Any Flir reps reading should forward Mike a sales commission  :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 31, 2013, 03:57:38 am
Bullet has been bitten... E4 ordered.
Any Flir reps reading should forward Mike a sales commission  :)
From traffic here and PMs alone , the current count is about six units so far....
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ixfd64 on October 31, 2013, 04:00:35 am
I keep getting a feeling that this thread alone will soon have a major impact on the thermal imaging industry. ;D
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: cosmos on October 31, 2013, 04:08:05 am
E4count ++
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 31, 2013, 04:22:28 am
E4count ++
poll added :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Mark_O on October 31, 2013, 04:46:54 am
For this sort of thing it would be handy to have a utility that would search for a binary string in a whole folder of files to find cross-references between DLLs. .EXEs etc. - anyone know of a good one?

010Editor is a good one, but it's not free.  Though you can run it for 30 days in a free-trial mode, with full functionality.

http://www.sweetscape.com/010editor/ (http://www.sweetscape.com/010editor/)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: olsenn on October 31, 2013, 05:20:43 am
I'm still waiting to see if the E4 can fully become an E8 or if it has a different lens etc.

I could certainly have some fun with a thermal camera :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: MFX on October 31, 2013, 05:29:46 am
Mike (and anyone else with an E4):

How useful would you estimate this particular camera is for taking images of PCBs, in enough detail to identify which components are getting warm (with or without the benefit of your recent work)?

Yes -
See pics on this post (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg316866/#msg316866)

The only issue at the moment is adjusting the lens for close-up focus -the lens can be adjusted without opening as it's only locked by the friction of the surrounding rubber, but it's a bit hard to grab hold of. 
 I am working on a tool to do this, as well as looking at using cheap laser cutter lenses

Looking at the moulding on the lens surround could you make a tool out of polymorph? Just soften it and push it against the lens surround.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 31, 2013, 06:01:05 am
Mike (and anyone else with an E4):

How useful would you estimate this particular camera is for taking images of PCBs, in enough detail to identify which components are getting warm (with or without the benefit of your recent work)?

Yes -
See pics on this post (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg316866/#msg316866)

The only issue at the moment is adjusting the lens for close-up focus -the lens can be adjusted without opening as it's only locked by the friction of the surrounding rubber, but it's a bit hard to grab hold of. 
 I am working on a tool to do this, as well as looking at using cheap laser cutter lenses

Looking at the moulding on the lens surround could you make a tool out of polymorph? Just soften it and push it against the lens surround.
Maybe - problem is it needs to be rigid enough to push against the outer ring, but hollow enough to not block too much field of view - currently looking at a PCB ring with pins.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: AndyC_772 on October 31, 2013, 06:07:18 am
Could you perhaps make an adjustment tool out of some 'chemical metal' or similar:

- Wrap a layer of epoxy around a dowel of a suitable diameter
- (optionally) cover with cling film to prevent deposits from contaminating the lens
- press into the splined adjuster surrounding the lens and remove
- allow to harden
- trim to a convenient length

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on October 31, 2013, 07:12:32 am
Mike,

You have mentioned the quality of the lens fitted in the E4. Can you explain a little more about why you believe it is not as good as that fitted in the E8. I know that the sensitivity specs differ a little but I am wondering if you have seen any other issues, such a distortion.

If the only issue is the sensitivity, I would not spend a lot of time replacing the lens as the E4 spec is respectable in that area.

I am fighting the urge to buy an E4 as I have the FLIR industrial units, but the design and lower weight of the E4 with 320x240 capability is very tempting. You have done some superb work on this camera and I am very pleased that you have potentially introduced many people to affordable thermal imaging at a decent resolution. You literally see the world differently when looking at it through a thermal camera. Your hack may actually create a demand for decent resolution at affordable prices that will encourage FLIR to consider whether selling a few for a lot of $ is as good as seller heaps for less $  :-//

The BBC are using thermal cameras in their wildlife programs these days and many watchers will be looking to do the same as it is far more convenient and effective than IR illumination and IR cameras.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 31, 2013, 09:49:16 am
Could you perhaps make an adjustment tool out of some 'chemical metal' or similar:

- Wrap a layer of epoxy around a dowel of a suitable diameter
- (optionally) cover with cling film to prevent deposits from contaminating the lens
- press into the splined adjuster surrounding the lens and remove
- allow to harden
- trim to a convenient length
I thought of that but don't think you'd get a well enough defined edge
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 31, 2013, 09:54:33 am
Mike,
You have mentioned the quality of the lens fitted in the E4. Can you explain a little more about why you believe it is not as good as that fitted in the E8. I know that the sensitivity specs differ a little but I am wondering if you have seen any other issues, such a distortion.

Simply that the E6 &8 have a better sensitivity spec,  I haven't seen anything that looks like it's related to sensitivity in the config file, and  that the nearly £4000 price difference might be at least in part down to better optics as opposed to cynical profiteering.
I don't know a great deal about optics but I think it's reasonable to assume that a lens that is 'just good enough' for 80x60 is cheaper than one that gets the best out of a 320x240 sensor.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: equinoxe on October 31, 2013, 10:20:08 am
I don't see any difference between the size of the E4 and the E8 lenses, maybe the coating is different??
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: TopLoser on October 31, 2013, 10:21:40 am
Mike,
You have mentioned the quality of the lens fitted in the E4. Can you explain a little more about why you believe it is not as good as that fitted in the E8. I know that the sensitivity specs differ a little but I am wondering if you have seen any other issues, such a distortion.

Simply that the E6 &8 have a better sensitivity spec,  I haven't seen anything that looks like it's related to sensitivity in the config file, and  that the nearly £4000 price difference might be at least in part down to better optics as opposed to cynical profiteering.
I don't know a great deal about optics but I think it's reasonable to assume that a lens that is 'just good enough' for 80x60 is cheaper than one that gets the best out of a 320x240 sensor.

I've got a spare 25mm diameter lens from a TIC if you think you could make use of it?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 31, 2013, 11:01:21 am
I don't see any difference between the size of the E4 and the E8 lenses, maybe the coating is different??
As the units look identical it is quite possible that online images of an E8 could actually be an E4. Or an E8 Or anything inbetween...
It is of course entirely possible that they are identical, or different, or have different coatings, or have a different shape inside

Here are some close-up pics - hard to see but the outer surface is concave.
X-ray indicates it is a single piece.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 31, 2013, 11:51:05 am
Mike,
You have mentioned the quality of the lens fitted in the E4. Can you explain a little more about why you believe it is not as good as that fitted in the E8. I know that the sensitivity specs differ a little but I am wondering if you have seen any other issues, such a distortion.

Simply that the E6 &8 have a better sensitivity spec,  I haven't seen anything that looks like it's related to sensitivity in the config file, and  that the nearly £4000 price difference might be at least in part down to better optics as opposed to cynical profiteering.
I don't know a great deal about optics but I think it's reasonable to assume that a lens that is 'just good enough' for 80x60 is cheaper than one that gets the best out of a 320x240 sensor.

I've got a spare 25mm diameter lens from a TIC if you think you could make use of it?
I have a few assorted  germanium optics - no had time to play yet. That one looks like it may be a bit big to be useable.
For what I want, screwing out the lens to get close focus seems to work pretty well, or at lead will do once I get a decent tool to adjust it more easily.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ron on October 31, 2013, 12:00:36 pm
Looks like you could make a focusing tool from a rubber stopper.  Or a piece of soft rubber/silicone tubing stretched over a short dowel leaving end of tubing extending past end of dowel.  Camera repair guys use these to disassemble lenses.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Corporate666 on October 31, 2013, 12:01:18 pm
Bullet has been bitten... E4 ordered.
Any Flir reps reading should forward Mike a sales commission  :)
From traffic here and PMs alone , the current count is about six units so far....

Make that seven.

Decided to upgrade from my i7 to an E4. 

The photo/thermal merging ability, plus the 320x240 ability, plus the ability to focus close for PCB work made it a no-brainer.

Another commission check for Mike :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Hypernova on October 31, 2013, 05:34:37 pm
Local dealer here in TW just gave me a quote for NT$48,300(1641USD) after tax, greedy bastards. Although if this is the only way to get one I might have to accept it.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Zoltan von Negrow on October 31, 2013, 06:23:28 pm
Local dealer here in TW just gave me a quote for NT$48,300(1641USD) after tax, greedy bastards. Although if this is the only way to get one I might have to accept it.


You are lucky for that 1641 USD. I gave in Czech republic 1800 USD,  :wtf:.

For that price, I will not have regrets to hack it to E8
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tnt on October 31, 2013, 06:38:45 pm
Well "official" price in europe is 995 EUR excl tax. So with taxes that's around 1650 USD.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Zoltan von Negrow on October 31, 2013, 06:49:14 pm
Well "official" price in europe is 995 EUR excl tax. So with taxes that's around 1650 USD.



Sorry for inaccuracy, its 1740 USD,  I used bad(month old) exchange rate.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: M. András on October 31, 2013, 06:50:01 pm
Well "official" price in europe is 995 EUR excl tax. So with taxes that's around 1650 USD.
yeah cos here 1usd=1eur if you are a buisness
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: equinoxe on October 31, 2013, 06:57:19 pm
Well "official" price in europe is 995 EUR excl tax. So with taxes that's around 1650 USD.
yeah cos here 1usd=1eur if you are a buisness

That, or what I also have seen: 1 usd = 1.5 Euro.. :(

BTW the Flir E4 is priced Eur 1200,- here in the Netherlands..
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on October 31, 2013, 07:03:53 pm
1200, or 1204? Because 995 ex btw is the cheapest I found...
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: PA0PBZ on October 31, 2013, 07:18:10 pm
for the Dutch guys: Conrad has them in stock and they have a 10% discount on everything going till monday, so that makes € 1.083,55 including tax.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on October 31, 2013, 07:29:10 pm
Beside the possibility that the lower thermal sensitivity might only be on paper just to differentiate the more expensive E8 etc. from the cheap E4, can't it be, that the lower thermal sensitivity is due to the fact that the camera downsamples from 320x240 to 80x60? As it combines then 4x4 pixel to 1 pixel (and possibly adds some noise) it looses sensitivity of course. I doubt that Flir uses different lenses; it would probably cheaper to order/manufacture large amounts of the same lens (also used in I-series?) than having 3 or even more different lenses.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on October 31, 2013, 08:15:07 pm
Beside the possibility that the lower thermal sensitivity might only be on paper just to differentiate the more expensive E8 etc. from the cheap E4, can't it be, that the lower thermal sensitivity is due to the fact that the camera downsamples from 320x240 to 80x60? As it combines then 4x4 pixel to 1 pixel (and possibly adds some noise) it looses sensitivity of course. I doubt that Flir uses different lenses; it would probably cheaper to order/manufacture large amounts of the same lens (also used in I-series?) than having 3 or even more different lenses.
It would be the opposite - avaraging 16 pixels would reduce noise, so if all other factors are identical, a downsampled image should have more temperature resolution, not less.
I don't think manufacturing cost savings due to volume come into it - The only thing that matters is minimum cost on the E4. There is plenty of headroom in the price of the higher models to cover any increased cost of smaller volumes of bigger lenses. I doubt we'd be talking more than $100 in the sort of volumes FLIR buy lenses in.
In terms of manufacturing process - remember they already fit a different LCD window to each model as it has the model number printed  on it, as well as a different side sticker. Screwing in a different lens wouldn't be a big deal.
 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: equinoxe on October 31, 2013, 10:51:49 pm
1200, or 1204? Because 995 ex btw is the cheapest I found...

1204, I rounded it to 1200.. ;)

Will conrad also give a discount on the Flir?
(I don't like Conrad. They always mess things up. Last time I ordered something from conrad I ended up waiting 3 months.. )
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: PA0PBZ on October 31, 2013, 11:03:43 pm
Will conrad also give a discount on the Flir?

Yes they do, I ordered one.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on October 31, 2013, 11:53:37 pm
for the Dutch guys: Conrad has them in stock and they have a 10% discount on everything going till monday, so that makes € 1.083,55 including tax.

Thanks for the tip!  :-+ I just ordered one.

And now let's hope Conrad doesn't fuck things up as per their usual modus operandi.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: CzokNorris on November 01, 2013, 02:28:26 am
If anyone knows, where I can buy one of these bare sensors or sensor assemblies, please let me know.
If I can get hold of one or two (without buying the whole camera) I would fit some germanium lens to it and implement the image processing on an FPGA.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 01, 2013, 02:39:53 am
If anyone knows, where I can buy one of these bare sensors or sensor assemblies, please let me know.
If I can get hold of one or two (without buying the whole camera) I would fit some germanium lens to it and implement the image processing on an FPGA.
Zero chance of that - manufactures won't talk to you unless you're doing volume. the only other route to cheap high-res is ex-vehicle night vision cams, but these tend to go on ebay for a similar price range to the E4.
e.g,
http://www.ebay.co.uk/itm/BMW-Night-Vision-Camera-/161126804979?hash=item2583e7edf3 (http://www.ebay.co.uk/itm/BMW-Night-Vision-Camera-/161126804979?hash=item2583e7edf3)
http://www.ebay.co.uk/itm/BMW-night-vision-camera-for-F-series-brand-new-original-in-original-packaging-/121122060732?pt=Motors_Car_Truck_Parts_Accessories&hash=item1c336ff9bc (http://www.ebay.co.uk/itm/BMW-night-vision-camera-for-F-series-brand-new-original-in-original-packaging-/121122060732?pt=Motors_Car_Truck_Parts_Accessories&hash=item1c336ff9bc)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on November 01, 2013, 03:00:42 am
Anyone thinking of buying one of those BMW or Audi thermal cameras for use rather than parts salvage, should be aware that the output from the module is propriatary data over LVDS. they are designed to only work with their associated ECU. Many have found out only after buying one -= money wasted  :scared:

The much older Raytheon BST based Cadillac thermal camera is Composite video output but the cameras are very expensive on the used market considering their poor performance when compared to the E4. The car mounted cameras are also vulnerable to stone chip damage to the Germanium lens, even when a lens protector was fitted.

This is a route into TIC ownership that I considered, and quickly discounted. If you can pick up a working Cadillac TIC for less than $300 then that would be reasonable for playing with. Such a unit offers no (repeat no) ability to influence its image output.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 01, 2013, 03:16:55 am
Anyone thinking of buying one of those BMW or Audi thermal cameras for use rather than parts salvage, should be aware that the output from the module is propriatary data over LVDS. they are designed to only work with their associated ECU. Many have found out only after buying one -= money wasted  :scared:

The much older Raytheon BST based Cadillac thermal camera is Composite video output but the cameras are very expensive on the used market considering their poor performance when compared to the E4. The car mounted cameras are also vulnerable to stone chip damage to the Germanium lens, even when a lens protector was fitted.

This is a route into TIC ownership that I considered, and quickly discounted. If you can pick up a working Cadillac TIC for less than $300 then that would be reasonable for playing with. Such a unit offers no (repeat no) ability to influence its image output.
I wonder if that data format is the same as the info I found ( I think for the Tau) , which looks indentical to the one on the E4 (the latter just not being LVDS).  This would be easy to decode - the only question is how much processing is needed of the data - for vision as opposed to thermography it's probably a lot simpler. 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: amiq on November 01, 2013, 03:40:53 am
I see these are advertised on aliexpress for $312 (minimum of 10 units) with free delivery to Europe/US.  Anyone interested in taking a punt?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 01, 2013, 04:38:01 am
I see these are advertised on aliexpress for $312 (minimum of 10 units) with free delivery to Europe/US.  Anyone interested in taking a punt?
Link? I'd be in for a couple at that price. Could be a nice little earner making an interface box to convert to composite.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: amiq on November 01, 2013, 04:42:22 am
http://www.aliexpress.com/item/FLIR-E4-Thermal-Imaging-Camera/1415663456.html (http://www.aliexpress.com/item/FLIR-E4-Thermal-Imaging-Camera/1415663456.html)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: amiq on November 01, 2013, 04:44:05 am
I'd be in for one - anyone else?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: daveshah on November 01, 2013, 04:49:12 am
Seller has no feedback score. Personally, I think it's a bit suspicious (otherwise I'd be in to buy one!).
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tnt on November 01, 2013, 04:54:15 am
For 312$ sure ... I'll take one.

But that indeeds looks very suspicious ... But aliexpress has buyer protection which works AFAIK.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: amiq on November 01, 2013, 04:56:11 am
Might well be a scam (although their buyer protection scheme has worked for me in the past).  I guess the question is are they really made in Estonia, or China?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 01, 2013, 05:03:09 am
Definite scam - thought the OP was referring to ex-BMW car ones, price maybe plausible for ones pulled from crashed cars
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: cosmos on November 01, 2013, 05:05:07 am
here is another one with lots of 35 for 248USD each,  FREE SHIPPING
http://www.aliexpress.com/item/Whoesale-FLIR-E4-Thermal-Imaging-Infrared-Camera/1434283893.html (http://www.aliexpress.com/item/Whoesale-FLIR-E4-Thermal-Imaging-Infrared-Camera/1434283893.html)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: amiq on November 01, 2013, 05:05:49 am
So are they definitely made in Europe (obviously a scam if they are).
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Zoltan von Negrow on November 01, 2013, 05:12:08 am
Might well be a scam (although their buyer protection scheme has worked for me in the past).  I guess the question is are they really made in Estonia, or China?

My arrived today from Sweden, but Made in  Estonia.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ron on November 01, 2013, 06:34:28 am
AliExpress  :palm:

http://www.resellerratings.com/store/AliExpress (http://www.resellerratings.com/store/AliExpress)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tnt on November 01, 2013, 06:39:13 am
wrt to the BMW camera, a friend of mine says that not only they use some proprietary crap, but it's also "protect". Attemptin to enable the camera too many times without properly authenticating seems to wipe the fw and brick it. And without auth, the sensor isn't even active (no clock, no nothing).
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 01, 2013, 07:44:33 am
wrt to the BMW camera, a friend of mine says that not only they use some proprietary crap, but it's also "protect". Attemptin to enable the camera too many times without properly authenticating seems to wipe the fw and brick it. And without auth, the sensor isn't even active (no clock, no nothing).
I bet that's just an eeprom count in the camera.
I suppose it is plausible there is some sort of security mechanism to make it hard to re-use due to the ITAR crap. If they wanted to it could be tied to the car's VIN to track ownership etc.
I'd really like to get hold of a 'bricked' camera if your friend knows of any going cheap  :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: M. András on November 01, 2013, 07:50:48 am
The E4 probably costs more than $300 to manufacture -- there's absolutely no way that listing is legitimate.
unless its from a stolen shipment
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on November 01, 2013, 09:19:00 am
Ref the BMW and Audi authentication....that must be what people were warning about in a thread I read on the difficulties of use outside the original car. My Audi contains many modules that are 'married' to the various primary computers fro Engine and interior systems. It is often done to prevent repair outside the Dealerships but that was fixed with VAGCOM  ;)  It is also used for to expensive in car entertainment modules as a theft deterrent. These defences have been getting more elaborate than the old eeprom but I am no expert in such. It could be that the expensive TIC is being protected from theft and resale ? If so, the protection could be pretty nasty as both BMW and Audi spend a lot on theft protection now.

As Mike says, a bricked unit may reveal its secrets. I have seen the modern BMW TIC units sell for almost $1000 though so little VFM when compared to the E4.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Corporate666 on November 01, 2013, 09:32:15 am
The Ali (baba/express) listings are either outright scams, or it could be counterfeit product shamelessly marked as the real thing.

More likely a scam, but I wouldn't be surprised to see some of the Chinese IR sensors showing up in counterfeit "FLIR" cameras.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 01, 2013, 09:34:29 am
As Mike says, a bricked unit may reveal its secrets. I have seen the modern BMW TIC units sell for almost $1000 though so little VFM when compared to the E4.
unless it's cheap because it's bricked. It could also be that the brickage is just in the processor box.

If they wanted to really go to town and be totally secure it could use a secure challenge-response handshake authentication thing between the processor box and the camera, but I have a feeling it probably doesn't.

I'm also curious about how they deal with the shutter cal on this unit - you wouldn't a night vision cam blinking at you...

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Stonent on November 01, 2013, 08:48:05 pm
As Mike says, a bricked unit may reveal its secrets. I have seen the modern BMW TIC units sell for almost $1000 though so little VFM when compared to the E4.
unless it's cheap because it's bricked. It could also be that the brickage is just in the processor box.

If they wanted to really go to town and be totally secure it could use a secure challenge-response handshake authentication thing between the processor box and the camera, but I have a feeling it probably doesn't.

I'm also curious about how they deal with the shutter cal on this unit - you wouldn't a night vision cam blinking at you...

Maybe they hold the last frame in the buffer while the shuttter flicks down or sort of buffer the video .5 or .25 seconds and give it some catch-up time while it calibrates.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on November 01, 2013, 08:54:49 pm
The problem wouldn't so much be lack of frames, but lack of frame updates. No use staring at last minute's idilic frame buffer when at this very instant you are heading straight towards a big moose/cow/kangaroo/alien*.

* Adjust for local wildlife setting.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Stonent on November 01, 2013, 08:57:04 pm
The problem wouldn't so much be lack of frames, but lack of frame updates. No use staring at last minute's idilic frame buffer when at this very instant you are heading straight towards a big moose/cow/kangaroo/alien*.

* Adjust for local wildlife setting.
Just go ahead and mow down the alien. You'll want good evidence before the black helicopters and suits arrive.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Mark_O on November 01, 2013, 09:13:05 pm
I had a play with the TargetNoiseMk setting and it does appear to be added noise.
There is a small, but noticeable difference between default value of 135 and a low setting of 13
I can only assume it's to reduce banding and/or give an impression of sharpness

Yes, it's for apparent sharpness, and makes images a bit more distinct.  I took your two 320x240 images, scaled each down to80x60 , then back up, and combined them.  Which side looks perceptually better now?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 01, 2013, 09:15:38 pm
The problem wouldn't so much be lack of frames, but lack of frame updates. No use staring at last minute's idilic frame buffer when at this very instant you are heading straight towards a big moose/cow/kangaroo/alien*.

* Adjust for local wildlife setting.
My guess is it's a fast shutter - if it's a 60fps imager, losing a few frames is probably tolerable. It could use avaraging over a few  shutter images to reduce noise in the reference image if necessary. Could also be a continuous wheel, and higher internal sample rate
It could also analyse the image for motion and only do a cal when there's not much action going on.
As it doesn't care much about actual temperature, Another option may be to analyse the incoming data for pixel-timescale variations and take a long-term avarage to estimate the variation between pixels. You may get occasional visual artifacts if the camera is looking at a stationary image for a while, but you don't really care about this for an automotive vision system as it's movement you're looking for.
Another alternative is they do a factory cal over a range of temps and store the nominal offsets for each pixel at each temperature.

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: amyk on November 01, 2013, 10:11:14 pm
The Ali (baba/express) listings are either outright scams, or it could be counterfeit product shamelessly marked as the real thing.

More likely a scam, but I wouldn't be surprised to see some of the Chinese IR sensors showing up in counterfeit "FLIR" cameras.
If I can get an actual working 320x240 or even 80x60 thermal imaging camera for $300, I don't care who or what made it... I'm betting more on "no product at all". Even the Chinese ones we found in the review thread were >$1000.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 01, 2013, 10:23:13 pm
This just arrived from Flir UK - do you think I should x-ray it before opening....?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on November 01, 2013, 10:29:11 pm
Whoa ! Were you expecting it ?

May be they have sent you an E8 as a gift for increasing sales of their E4  :-//

That would certainly be a very nice gesture. They may wish to thank you for highlighting the vulnerabilities of their software build. Or it may be a new case as you slightly mangled yours opening it ?

You have me sat on the edge of my seat waiting to see what they have sent you  :)

I wish I got boxes from FLIR...... they usually contain very nice "goodies"

Good PR for FLIR if it is something nice, bad PR if it explodes on opening  :-DD

OPEN IT....OPEN IT NOW ! (Please  ;)  )
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 01, 2013, 10:29:55 pm
OK stand down the bomb squad - just the soft case they'd promised - so at least  they're still talking to me (or haven't seen this thread yet...)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on November 01, 2013, 10:33:14 pm
OH ! .....disappointed  :'(

I thought we were going to witness an amazing act of generosity from the PR people at FLIR.

Too much to ask I suppose.

Thanks for opening it and posting so quickly.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on November 01, 2013, 11:36:00 pm
As car thermal cameras have been mentioned. I attach a datasheet on AutoLiv as it contains specs etc. I believe this is the system fitted to Audi and BMW cars. It uses LVDS for the cameras video data and CAN Bus for the communication with the ECU. Sadly no mention of how the system copes with auto calibration events. As the ECU forms part of a pedestrian protection system with trajectory projection used for warnings, it may be that the short calibration period is not an issue as the ECU will have already spotted a target some distance away and may delay the calibration routine until the 'target' is passed. These systems appear to be a pedestrian and animal detection safety fitment and are not intended as a true night vision system for driving/piloting a vehicle, with it as the primary vision system (as used by military pilots).


Autoliv website:

http://www.autoliv.com/Pages/default.aspx (http://www.autoliv.com/Pages/default.aspx)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 02, 2013, 01:53:07 am
May be they have sent you an E8 as a gift for increasing sales of their E4  :-//
Well they may have trouble selling them, so might as well give a few away...
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: CzokNorris on November 02, 2013, 04:17:30 am
They use the nigtvision cams (three generations by now) for Audi and BMW premium cars. All from FLIR. Mercedes uses another technology which is basically adding a very strong IR Headlight which illuminates the street without dazzling other drivers (due to the invisibility of IR) and then just using a standard camera for near infrared. So no thermal on Mercedes.

Audi and BMW use standard shutters, no shutter wheel (see image) and probably try to make it as fast as possible (fraction of a second, a few frames) and maybe also combining several shutter sequences together.
The sensor seems the same with the on die ADC.

Unfortunately they use a proprietary interface called LIN which is a high speed differential link for automotive applications to transmit the signal an they also use a cryptographic handshake over CAN-Bus with a unique car identifier with some properitary challenge-response-system to ensure that cameras cannot be retrofitted to another car and only work with the one they are bought with. And of course due to the Dual use bla bla...
It looks like the cam also gets into some lock state, when one tries to send wrong messages to it and it bricks itself...

There is one car night vision camera which works without the cryptographic handshake with the cars main controller which is a Caddilac one (very hard to get here in germany). This camera just outputs NTSC when applied power, but has a reduced resolution of 320x120 which is interlaced to 320x240... So if you over there in 'merica can get your hands on one of these, i would not hesitate as long as the price is ok...

Since I am just interested in the bare sensor, i will try to score one of the Audi or BMW anyway. I don't care if it bricks itself, as long as it does not burn the sensor somehow :-) Cool tip with the car cams btw, mike, thanks for that!!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: CzokNorris on November 02, 2013, 04:19:08 am
Huh, seems to have lost the second image of the shutter for Audi.. Here it is again...  :-+
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 02, 2013, 04:36:12 am
The sensor seems the same with the on die ADC.
That looks identical to the E4 one - not at all surprising.
At some point I will make a riser board to look at what signals go into the sensor - my guess is the lockout on the car ones is just a flag to tell the FPGA to not do anything. I have no doubt there is some way to reset this via CAN with the right tools. Must have a word with my mate who does dodgy stuff to cars...
Quote
Unfortunately they use a proprietary interface called LIN which is a high speed differential link for automotive applications to transmit the signal an they also use a cryptographic handshake over CAN-Bus with a unique car identifier with some properitary challenge-response-system to ensure that cameras cannot be retrofitted to another car and only work with the one they are bought with. And of course due to the Dual use bla bla...
It looks like the cam also gets into some lock state, when one tries to send wrong messages to it and it bricks itself...
LIN is a low-speed cheap serial bus, typically used between a CAN node and small devices, e.g. a door may have CAN into the door to a door controller, then LIN to the various switches etc. withn the door.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: 0xdeadbeef on November 02, 2013, 05:13:33 am
Yep, LIN is the low end replacement for CAN - for sensors and actuators where you don't need CAN.
Not proprietary at all. In the end it's more or less an UART with a different transceiver and a bit of protocol on top.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: CzokNorris on November 02, 2013, 05:43:09 am
Sorry, i mixed it up...
I meant LVDS
The video interface is called LVDS
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: aargee on November 02, 2013, 08:29:54 am
This just arrived from Flir UK - do you think I should x-ray it before opening....?

I thought it was going to be a box of legal documents!  :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ixfd64 on November 02, 2013, 09:12:23 am
Any update on the hidden menu?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: 0xdeadbeef on November 02, 2013, 09:13:01 am
Sorry, i mixed it up...
I meant LVDS
The video interface is called LVDS
LVDS just means low voltage differential signals. Probably it's flat panel display link (FPD) which uses LVDS and is therefore often (mistakenly) called LVDS.
At least this is common for notebooks and stuff like the Raspberry Pi.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: cyr on November 02, 2013, 09:27:58 am
Or cameralink which is basically the same serial LVDS interface but for camera sensors...
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 02, 2013, 09:33:58 am
This PDF documents the LVDS format used by Flir's Tau 2 cameras, which looks the same as the datastream from the E4 sensor, and possibly the automotive units
 http://storage.pardot.com/6132/83776/Tau2_Electrical_IDD.pdf (http://storage.pardot.com/6132/83776/Tau2_Electrical_IDD.pdf)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: zapta on November 02, 2013, 10:30:46 am
Will a kind soul please post here a short summary with the status of the E4 hacking. I am trying to avoid reading all the 33 pages. ;-)

I do have a E4 and would love to increase its resolution.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 02, 2013, 10:40:23 am
Now tested by a couple of users, confirmed on FW 1.18.7 and 1.18.8
Files attatched.

Warning : take care not to break stuff!
This hack may be resilient to firmware updates. Maybe.
But may be best to remove prior to update and replace after, just in case.

Open E8.cfg in a PC text editor (not anything that will mangle linefeeds etc.!)

At the end of the file, replace xxxxxxxx with the 8-digit serial number of your camera

Save the file (Make sure there is exactly one CRLF at the end of the file)

At a PC command prompt, run

  CRC01 E8.cfg  (on the edited file)

This will display a line in the form
# CRC01 xxxxxxxx

Add this line to the end of the E8.cfg file, so it now looks like :

  # ID xxxxxxxx
  # CRC01 yyyyyyyy

where xxxxxxxx is your serial number and yyyyyyyy is the generated CRC
(should be exactly one CRLF after the CRC)

Save the file.

Plug the E4 into USB and open the file folder

Copy the new E8.cfg and copyhack.bat files to the root of the E4 file folder

Unplug USB (Important - otherwise filesystem won't be visible within E4 !)
Wait 5 seconds to ensure E4 has re-mounted the file system. If you get a "file not found" at the next step, wait 5 secs and retry.

Connect to serial console (38K4 baud 8N1)  using Hyperterminal or whatever. press enter until \> prompt appears

Type :
 \flashifs\copyhack

Remove battery, replace and restart. Unit will now start up like an E8.

The files can be removed from the camera's drive

Enjoy!

-----------------------------------------------------------------------
If the new file is wrong, the only symptom will be that the unit will behave like an E4.
Quickest way to tell is to look for the extra measure, display and palatte menu options

-----------------------------------------------------------------------------
Pinout for serial console

FFC connector accessable under label on front of lens housing
Looking at lens side with handle down
You may find it easier to further disassemble than get the label off without damage. Take care  not to lose the lens cover spring - see teardown video.

<left edge> <pin 16>....<pin 1>
Contacts are on bottom side (towards handle)
Pin 3 RXD
Pin 4 TXD
Pin 16 or 8 ground

Use 3.3v TTL level interface, e.g. FTDI TTL-232-3v3 cable

TTL232 Pin 1 (0v) to ground
TTL232 Pin 4 (TXD) to RXD
TTL232 Pin 5 (RXD) to TXD

Suggested FFC jumper cable molex Molex 0210200165 or similar.
If using a 5V serial adapter, use a 10K resistor in series with the adapter's TXD
--------------------------------------------------------------
De-hacking
Using serial console, delete \flashfs\system\appcore.d\config.d\e8.cfg
--------------------------------------------------------------------------

Changing startup screen (cold boot only)
Replace \flashbfs\system\bootlogo_legal.bmp ( copy from USB filesystem as per other files)
Original is 320x240 8 bpp windows bitmap.
Beware of changing format, as if progressapp crashes it may not run the console prompt




 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: zapta on November 02, 2013, 02:56:22 pm
Thanks a lot mike!

A  questions:

1. How about adding this procedure to the bottom of the original post in this thread?  It will be easier to find it.

2. What will be the end result of this mod? A full E8 resolution and functionality?

3. "Wait 5 seconds to ensure E4 has re-mounted the file system"   - how do I verity the the file systems was re mounted?

4. Any chance of posting a picture of the serial connector with pin 1 annotation?

5. How do you connect the USB serial adapter to the Molex 0210200165? Can it be soldered? Using a matching connector.

Thanks again. This is an awesome hack!

Z.



Title: Re: Flir E4 Thermal imaging camera teardown
Post by: equinoxe on November 02, 2013, 06:09:03 pm
Wow, great hack!! THANKS!! (do not own an e4 yet.. but that may change in the future)

Mike, I looked at the E8 config, and I wonder: what would happen if one would change the following, could one get extra functions?:

.caps.config.image.sysimg.irMarkers.box.enabled bool false
.caps.config.image.sysimg.visualMarkers.box.enabled bool false

.caps.config.image.sysimg.irMarkers.spot.enabled bool false
.caps.config.image.sysimg.visualMarkers.spot.enabled bool false

.caps.config.image.sysimg.measureFuncs.mcircle.enabled bool false

.caps.config.image.sysimg.measureFuncs.mline.enabled bool false

Or
.caps.config.image.sysimg.measureFuncs.isotherm.dual bool false


and this one:

.caps.config.image.zoom.enabled bool false

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on November 02, 2013, 06:50:14 pm
Now tested by a couple of users, confirmed on FW 1.18.7 and 1.18.8
Files attatched.
Great work, thanks!  :-+ I just got the tracking info for my E4 ... can't wait to start playing with it.

3. "Wait 5 seconds to ensure E4 has re-mounted the file system"   - how do I verity the the file systems was re mounted?

You verify this by NOT getting a "file not found" error in the next step. If you do get the error, simply wait a bit and try again. The 5 seconds is just an arbitrary "should be long enough" pause to give win ce some time to sort things out after the usb disconnect.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 02, 2013, 07:53:31 pm
Now tested by a couple of users, confirmed on FW 1.18.7 and 1.18.8
Files attatched.
Great work, thanks!  :-+ I just got the tracking info for my E4 ... can't wait to start playing with it.

3. "Wait 5 seconds to ensure E4 has re-mounted the file system"   - how do I verity the the file systems was re mounted?

You verify this by NOT getting a "file not found" error in the next step. If you do get the error, simply wait a bit and try again. The 5 seconds is just an arbitrary "should be long enough" pause to give win ce some time to sort things out after the usb disconnect.
I haven't tried all of them but a lot of these got enabled by the earlier service mode hack (e.g. zoom) and didn't seem to do anything. I'm fairly sure a lot of these relate to features which are either not implemented in the E4 software and/or UI menu structure, or need buttons which aren't present. 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Zoltan von Negrow on November 02, 2013, 08:56:35 pm
Now tested by a couple of users, confirmed on FW 1.18.7 and 1.18.8


My E4 is 1.19.8. I hope that hack will be working on that firmware.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on November 03, 2013, 12:34:42 am
Incidentally, you can find some win ce 6.0 resources for that MCIMX257 cpu that's in the E4 at this freescale link (http://www.freescale.com/webapp/sps/site/prod_summary.jsp?code=IMX25_SW). Docs + BSDL file don't require login, the WIN CE 6.0 source does.

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Hypernova on November 03, 2013, 12:50:07 am
Well, I just finished wiring the local distributor the payment for my E4, so for this month, after accounting for income tax, rent, food etc I am left with less than $100 to put in the piggy bank. Damn you Mike, damn you!!!  :D
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 03, 2013, 03:58:16 am
My E4 is 1.19.8. I hope that hack will be working on that firmware.
Did you see any differences from the 1.18.8 firmware (see review video)? E.g. is the joystick in the middle connected with any action (without pressing the middle button before)?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Zoltan von Negrow on November 03, 2013, 04:36:51 am
My E4 is 1.19.8. I hope that hack will be working on that firmware.
Did you see any differences from the 1.18.8 firmware (see review video)? E.g. is the joystick in the middle connected with any action (without pressing the middle button before)?


No, any actions on joystick. I´am afraid of anti-hack firmware. Mike will sent me FFC breakout PCB, I will hack my E4 ASAP, and we will see.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on November 03, 2013, 04:49:20 am
Can you see any differences between files on your E4 and older firmware files?

At any rate, it will be interesting to see if this is a regularly scheduled boring update, or an OMG th3 h4X0rZ quick fix. Does anyone know how often Flir typically do their updates? And what is their policy in making these updates available for download. As in, there apparantly are devices with 1.19.8 firmware out there, but I can't find any mention of this firmware on the flir website.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 03, 2013, 05:06:28 am
Can you see any differences between files on your E4 and older firmware files?

At any rate, it will be interesting to see if this is a regularly scheduled boring update, or an OMG th3 h4X0rZ quick fix. Does anyone know how often Flir typically do their updates? And what is their policy in making these updates available for download. As in, there apparantly are devices with 1.19.8 firmware out there, but I can't find any mention of this firmware on the flir website.
1.18.8 isn't there either. Could be that the update is only for their internal functions - production test etc. or E8 features when are not currently enabled in the hack .cfg file.
I have it on good authority that they are planning something to improve the UI but no timescale.
the latest manual is also slightly out of step in that it shows multiple PiP sizes, but the current FW only supports one ( as seen in UI files).
I'd be interested to see the .cfg and UI files in the later firmware.
 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: SeanB on November 03, 2013, 05:21:36 am
I wonder if the serial port is fed to the pads on the board for a bluetooth module? then it will be simple to just get a BT serial module and populate the board pads for the module and you will have the serial terminal available without any cable needing to be inserted. Pair the module with a PC or phone with terminal software and you will have another comms method.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Zoltan von Negrow on November 03, 2013, 05:53:48 am
Can you see any differences between files on your E4 and older firmware files?

At any rate, it will be interesting to see if this is a regularly scheduled boring update, or an OMG th3 h4X0rZ quick fix. Does anyone know how often Flir typically do their updates? And what is their policy in making these updates available for download. As in, there apparantly are devices with 1.19.8 firmware out there, but I can't find any mention of this firmware on the flir website.

I haven´t older firmware to compare, its shipped with 1.19.8
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: PA0PBZ on November 03, 2013, 05:57:01 am
Almost there!

If you install the Flir tools there is a file in the bin map: FlirInstallNet.exe which opens a telnet and ftp connection over the standard USB connection !

Just run the program, click the [Get Versions] button and be surprised.
Oh yes, the [Get resource] button is nice too.

The communication stuff is in the Flir.Cronos.Net.CameraUpdate.FIFEngine.dll

It also creates a nice log file, viewable when clicking the [L] button:

Code: [Select]
<cut>
FIF::UVCCommandDispatcher::DispatchMessageA sending message:
FIF::UVCCommandDispatcher::DispatchMessageA sending message: start cmd
CMD started successfully.
FIF::FIFInstallerEngine::OnCommandDispatcherMessage
Received shell command message:
FLIR Command Line Interpreter
Version 0.4.3 running on WinCE 6.0

\>
<cut>

Now a little USB sniffing and we have a closed-box hack  >:D
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 03, 2013, 06:05:31 am
Sorry, why the USB sniffing? What's missing?
Once you have a console, you have the hack.... All you need to be able to do is copy one file from the user partition to flashfs
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: PA0PBZ on November 03, 2013, 06:21:53 am
Sorry, why the USB sniffing? What's missing?

The console....
There is no text input.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: madpuma13 on November 03, 2013, 06:23:05 am
So I was in the process of purchasing (awaiting for it to ship an E6 unit) when I came across a review video from Mike for the e4. He seemed to be very thorough and so I looked at some of his other videos and came across this teardown thread.

I watched the video and was amazed at everything mike was doing (nearly all of it went over my head). In any case I notice the thread is quite long so I jump to the end and their is discussion of the E4 being modded to be an E8.

I saw Mikes most recent post and am curious as to what exactly this mod does to the E4. I know it is very common for manufactures to put the full capabilities into some electronic items and gimp the lower end models via software to lower production costs. However, they usually have it locked or encrypted.

So because i cant find anywhere that makes it clear, what is the end result of this mod? Does it turn into a fully functional (higher res thermal image, picture in picture, all other options) E8? Or what exactly does it do? Any help appreciated, maybe I have time to cancel my order.

I might also suggest making an entirely new thread or updating the first post of this one with this info to make it easier to locate. UNless of course you dont want it to be found that easily to make this mod possible for as long as possible before it gets eliminated via an update.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 03, 2013, 06:40:22 am

So because i cant find anywhere that makes it clear, what is the end result of this mod? Does it turn into a fully functional (higher res thermal image, picture in picture, all other options) E8?
Yes.
The only thing we don't currently know is if the E6 and/or 8 have a better lens.
Quote
I might also suggest making an entirely new thread or updating the first post of this one with this info to make it easier to locate. UNless of course you dont want it to be found that easily to make this mod possible for as long as possible before it gets eliminated via an update.

There is still some ongoing work to see if it can be done without opening the case. And isn't it worth some time spent reading to get this much added upgrade...? :D
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on November 03, 2013, 07:11:28 am
UNless of course you dont want it to be found that easily to make this mod possible for as long as possible before it gets eliminated via an update.

Nah, that's not it. He just want to give other people the chance as well to cultivate patience and persistence. :) Not that hard to through 30-ish pages. Besides, that's a useful skill too. Quickly getting the useful tidbits from long threads. ;)

No doubt when all is done there will be a summary, but if you want it now now then you can always read the thread.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on November 03, 2013, 07:20:04 am
Sorry, why the USB sniffing? What's missing?

The console....
There is no text input.

When it's sending those commands over USB, do you see any extra usb-serial devices? Probably not, but it's worth checking. It would be totally easy if you could get it to register itself as a usb-serial adapter.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: madpuma13 on November 03, 2013, 07:20:35 am
Most definitely not hard to go through it all. I am doing so as we speak. The only reason I posted at all to find out exactly what the mod did instead of finding it myself was because of my current order for the E6. I wanted to cancel it as early as possible.

Thank you very much for answering promptly. You saved me the hassle of returning my unit (hopefully) and $1500.

I am a programmer by trade and like I said, most of what Mike did went over my head but I will be looking forward to donating toward this forum and some beer money for mike if he lets me know how  :)

Thanks again! and keep up the great work!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Wann on November 03, 2013, 07:22:51 am
Ok. Been lurking for a while...
Just chiming in with an idea:

So it seems that you can take:

camera.cmd
eFLIRinstall_MSD.dat
FLIRLaunch.dat

From the original .fif firmware file, modify them (camera.cmd to run Mike's hack command, FLIRLaunch.dat to not check for CRC?)

Pack them with no compression using 7zip together with Mike's e4hack folder, change .zip to .fif.
When opening this file in FLIRInstallNet.exe and pressing "CMD" the new commands from camera.cmd appears.

So pressing "Run FIF", run commands from camera.cmd? Could we make our own .fif hack file?
Maybe just start with activating RNDIS...

FIF test file below. Change .zip to .fif. Please do not run it :-)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 03, 2013, 07:22:59 am
Just had a thought... if you look at the contents of the installer .cab, there is a script file camera.cmd
If it is possible to create a new firmware .cab/.fif which can pass any required signing/CRC check, It should be possible to produce a new /cmd file whose sole purpose is to copy the one config file.

If course that is a big If....

Code: [Select]
## 10
# Combined fif installation for "ASCO Z3"
# Start by examining camera components. Use md to note state for later coming
# handlers.
# Note: This initial check code should not use "addfile" to ease/speed up
# execution with "eFLIRInstall" when camera is already updated
#
#old kit without gethwtype. Use os name for identify
type \windows\osimgkit.rev
[NAME ASCO*][$GOTO isOScorrect]
$FAIL "Update is intended for FLIR Z3-Series - not this camera - aborts install"
$GOTO end
#
$LABEL isOScorrect
## 12_header.spec

$SHOW "Combined firmware (1.18.7) is intended for FLIR Z3-Series"
# Clean from potential earlier install
rmdir \temp\OS
rmdir \temp\APP
rmdir \temp\PROD
#
#
## 20
#check OS - appcore independent check
type \windows\osimgkit.rev
[*1.0.0*}][$GOTO wrongOS]
[*16.0.10*][$GOTO checkOSEnd]
#Here if OS is not 16.0.10, mark OS for update
md \temp\OS
$GOTO checkOSEnd
#
#
$LABEL wrongOS
$SHOW "OSimage need to bigger than 1.0.0! Install OS-image manualy first",2
$GOTO end
$LABEL checkOSEnd
## 30
rls .version.kits.appkit.ver
[*1.0.13"*][$GOTO extendedCheckApp]
[*Bad command*][$GOTO appUnknown]
[*bad data*][$GOTO appUnknown]
[*failed*][$GOTO appUnknown]
$GOTO setAPPforupdate
$LABEL extendedCheckApp
kitcrc -c \FlashBFS\system\kits.d\appkit.rev
[*FAIL*][$GOTO setAPPforupdate]
$GOTO checkAppEnd
$LABEL appUnknown
#Not possible to check app - assume update
$FAIL "***Warning*** Unable to check camera! Press ignore to install anyway",2

$LABEL setAPPforupdate
md \temp\APP
$LABEL checkAppEnd
## 40
rls .version.kits.prodkit.ver
[*"1.0.0.7"*][$GOTO extendedCheckProd]
[*Bad command*][$GOTO prodUnknown]
[*bad data*][$GOTO prodUnknown]
[*failed*][$GOTO prodUnknown]
$GOTO setPRODforupdate
$LABEL extendedCheckProd
kitcrc -c \FlashBFS\system\kits.d\prodkit.rev
[*FAIL*][$GOTO setPRODforupdate]
$GOTO checkPRODEnd
$LABEL prodUnknown
#Not possible to check prod - assume update
$FAIL "***Warning*** Unable to check camera! Press ignore to install anyway",2
#
$LABEL setPRODforupdate
md \temp\PROD
#
#
#
$LABEL checkPRODEnd
## 50
$LABEL cont1
# Now we should have an analyse of needed updates noted as directories in \temp
dir /B \temp
[*OS*][$GOTO cont2]
[*APP*][$GOTO cont2]
[*PROD*][$GOTO cont2]
$FAIL "Camera is already updated",1
# If continued here, user wants to force an update
md \temp\OS
md \temp\APP
md \temp\PROD
#
$LABEL cont2
# Update decisions has been taken, stop app applications
$SHOW "Will now update OS/appkit/prodkit"
# Try to stop applications
rset .services.log.active false
rset .watchdog.enable false
ps -k facet
ps -k Facet
ps -k Fenix
ps -k fenix
ps -k uicore
ps -k Gui
ps -k Prod
ps -k prod

...snip


addfile flashbfs/system/web/service/focus/index.asp
addfile flashbfs/system/web/service/focus/laser.asp
addfile flashbfs/system/web/service/focus/lensdist.asp
addfile flashbfs/system/web/service/imgcorr/activatedigfilters.asp
addfile flashbfs/system/web/service/imgcorr/gainmap.asp
addfile flashbfs/system/web/service/imgcorr/gainmapcalc.asp
addfile flashbfs/system/web/service/imgcorr/gainmapcalcgf.asp
addfile flashbfs/system/web/service/imgcorr/gainmapcold.asp
addfile flashbfs/system/web/service/imgcorr/gainmapresult.asp
addfile flashbfs/system/web/service/imgcorr/gainmapselcase.asp
addfile flashbfs/system/web/service/imgcorr/gainmapwarm.asp
addfile flashbfs/system/web/service/imgcorr/imgcorrselcase.asp
addfile flashbfs/system/web/service/imgcorr/index.asp
addfile flashbfs/system/web/service/imgcorr/operability.asp
addfile flashbfs/system/web/service/imgcorr/operabilitylog.asp
addfile flashbfs/system/web/service/imgcorr/pixkill.asp
addfile flashbfs/system/web/service/imgcorr/shuttermap.asp
addfile flashbfs/system/web/service/imgcorr/staticmap.asp
addfile flashbfs/system/web/service/imgcorr/staticmapcalc.asp
addfile flashbfs/system/web/service/imgcorr/staticmapcold.asp
addfile flashbfs/system/web/service/imgcorr/staticmapprepare.asp
addfile flashbfs/system/web/service/imgcorr/staticmapresult.asp
addfile flashbfs/system/web/service/imgcorr/staticmapwarm.asp
addfile flashbfs/system/web/service/inc/accmeasprottempl.inc
addfile flashbfs/system/web/service/inc/calibprottempl.inc
addfile flashbfs/system/web/service/inc/eepromlock.inc
addfile flashbfs/system/web/service/inc/errorcodes.inc
addfile flashbfs/system/web/service/inc/servicemenu.inc
addfile flashbfs/system/web/service/inc/serviceutils.inc
addfile flashbfs/system/web/service/index.asp
addfile flashbfs/system/web/service/ppr.asp
addfile flashbfs/system/web/service/ppri.htm
addfile flashbfs/system/web/service/tdrift/curcomp.asp
addfile flashbfs/system/web/service/tdrift/index.asp
addfile flashbfs/system/web/service/tdrift/logging.asp
addfile flashbfs/system/web/service/tdrift/sensors.asp
addfile flashbfs/system/web/smallcam.asp
addfile flashbfs/system/web/styles/flirweb.css
addfile flashbfs/system/web/sysinfo.asp
addfile flashbfs/system/web/web-addon/a-web-addon/inc/camtype.inc
addfile flashbfs/system/web/web-addon/a-web-addon/index_s.asp
addfile flashbfs/system/web/web-addon/a-web-addon/index_us.asp
addfile flashbfs/system/web/web-addon/a2-web-addon/inc/camtype.inc
addfile flashbfs/system/web/web-addon/a2-web-addon/index_s.asp
addfile flashbfs/system/web/web-addon/a2-web-addon/index_us.asp
addfile flashbfs/system/web/web-addon/e-web-addon/inc/camtype.inc
addfile flashbfs/system/web/web-addon/e2-web-addon/inc/camtype.inc
addfile flashbfs/system/web/web-addon/e3-web-addon/inc/camtype.inc
addfile flashbfs/system/web/web-addon/fx-web-addon/inc/camtype.inc
addfile flashbfs/system/web/web-addon/g-web-addon/inc/camtype.inc
addfile flashbfs/system/web/web-addon/p-web-addon/inc/camtype.inc
addfile flashbfs/system/web/web-addon/prem-web-addon/inc/camtype.inc
addfile flashbfs/system/web/web-addon/prem-web-addon/service/inc/servicemenu.inc
addfile flashbfs/system/web/web-addon/pt-web-addon/inc/camtype.inc
addfile flashbfs/system/web/web-addon/x-web-addon/inc/camtype.inc
addfile flashbfs/system/web/web-addon/x2-web-addon/inc/camtype.inc
addfile flashbfs/system/web/web-addon/z-web-addon/inc/camtype.inc
addfile flashbfs/system/web/web-addon/z3-web-addon/inc/camtype.inc
addfile flashbfs/system/web/webcam.asp
addfile flashbfs/system/web/webpopup.asp
## 110
$LABEL checkinstallProdEnd
#
#
#

## 130

# EOF Post commands
#
#FIF Add a temporary config
# No need
#
$SHOW "Camera will now restart",7
restart
$DISCONNECT
$WAIT 40
$RECONNECT 5 
DEL /f /s /q \FlashBFS\system\xx*

#
rls .version.swcombination.ver
[*1.18.7"*][$GOTO successful1]
$FAIL "Failed update,wrong version after restart",4
$GOTO end

$LABEL successful1
# Check if crc have changed
kitcrc -c \FlashBFS\system\kits.d\appkit.rev
[*FAIL*][$GOTO failed2]
kitcrc -c \FlashBFS\system\kits.d\prodkit.rev
[*FAIL*][$GOTO failed2]

$LABEL showSuccess
$SHOW "Successfully updated combined firmware to version 1.18.7"
$GOTO end

$LABEL failed2
$FAIL "Failed update, file checksum error",3

$LABEL end
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Wann on November 03, 2013, 07:28:33 am
I beat you by 8 seconds...  ;D
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 03, 2013, 07:46:55 am
The greyed-out CMD and Files buttons in FlirInstallNet.exe look interesting
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Wann on November 03, 2013, 07:48:20 am
And we got RNDIS working via .fif ...

Thank you Mike and everybody else that have been working on this hack.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on November 03, 2013, 08:02:00 am
I beat you by 8 seconds...  ;D

I beat you by eons (internet time).

At any rate, camera.cmd is full of inspiration.

But if you managed to generate a working .fif that copies the RNDIS files, then good job.  :D
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 03, 2013, 08:06:08 am
In that case all you need to do is put your CRC'd E8.cnf  in the .fif, and put
Quote
copy e8.cfg \flashfs\system\appcore.d\config.d\e8.cfg
in the .cmd file
Job Done.

I'm amazed it doesn't check the integirity of the .fif...
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Wann on November 03, 2013, 08:06:31 am
Ahhhh. Shoot...   ::)

Kudos.


I beat you by 8 seconds...  ;D

I beat you by eons (internet time).

At any rate, camera.cmd is full of inspiration.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Wann on November 03, 2013, 08:08:31 am
I'm amazed it doesn't check the integirity of the .fif...

There is some CRC in FLIRLaunch.dat. I commented it out just to be sure  :-//
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 03, 2013, 08:18:37 am
Would be nice to be able to copy the cfg from the USB partition, but this won't be mounted when plugged in to USB.
I think we need to use addfile, and create the equivalent path in the install fif
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on November 03, 2013, 08:23:22 am
I think we need to use addfile, and create the equivalent path in the install fif

addfile would be the way to go yes. Same mechanism as camera.cmd uses to copy the new firmware files during an update.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Wann on November 03, 2013, 08:26:09 am
So e8.cfg should be in \flashfs\system\appcore.d\config.d\e8.cfg in the .fif?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 03, 2013, 08:28:04 am
Yep - just tested and it works. Just trying again from a clean boot with no pre-existing hack file

..and of course you should be able to use the same method to install a custom boot screen
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Wann on November 03, 2013, 08:28:37 am
YAY!

Yep - just tested and it works. Just trying again from a clean boot with no pre-existing hack file
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Wann on November 03, 2013, 08:38:20 am
Yep - just tested and it works. Just trying again from a clean boot with no pre-existing hack file

..and of course you should be able to use the same method to install a custom boot screen

Confirmed  :-+

Ahhh. The resolution  ;D

Now everbody be quiet as a mouse. Maybe FLIR will not find out about this. Maybe we should delete the last hour of posts?  :scared:
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on November 03, 2013, 08:38:43 am
Yep - just tested and it works. Just trying again from a clean boot with no pre-existing hack file

Neat!  :-+ Now there really is nothing left to do for when I get my E4.  ;D Well, except set up a toolchain and make some small apps. Or did maybe someone beat me to that as well? That would be awesome, because I'd love to get some details on how to set up the toolchain for this device. XD

Edit: forgot to ask, how much space is left on the flash device?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 03, 2013, 08:45:25 am
Only needs the camera.cmd in the zip
Quote
addfile flashfs/system/appcore.d/config.d/e8.cfg
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Wann on November 03, 2013, 08:57:22 am
Only needs the camera.cmd in the zip
Quote
addfile flashfs/system/appcore.d/config.d/e8.cfg

That is just too easy...

So when FLIR is uploading new firmware, we should basically be keeping our fingers off?
Or there's no way they can block this?  :box:
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Wann on November 03, 2013, 09:00:49 am
Edit: forgot to ask, how much space is left on the flash device?

173 MB...  :=\
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tnt on November 03, 2013, 09:03:42 am
So when FLIR is uploading new firmware, we should basically be keeping our fingers off?
Or there's no way they can block this?  :box:

There is _plenty_ of ways they could block this ... too many to enumerate and I wouldn't want to give them ideas ...
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 03, 2013, 09:09:43 am
Updated 3rd Jan - enabled zoom in .cfg for Taucher's Beta3 menu hack zoom function.


OK, so this is it.....
Seems to not be bothered about 7zip - I just used Windows "send to compressed folder"

Open E8.cfg in a PC text editor (not anything that will mangle linefeeds etc.!)

At the end of the file, replace xxxxxxxx with the 8-digit serial number of your camera

Save the file (Make sure there is exactly one CRLF at the end of the file)

At a PC command prompt, run

  CRC01 E8.cfg  (on the edited file)

This will display a line in the form
# CRC01 xxxxxxxx

Add this line to the end of the E8.cfg file, so it now looks like :

  # ID xxxxxxxx
  # CRC01 yyyyyyyy

where xxxxxxxx is your serial number and yyyyyyyy is the generated CRC
(should be exactly one CRLF after the CRC)
"CRC" is case sensitive - must be upper case. "01" is zero one

Save the file as flashfs\system\appcore.d\config.d\e8.cfg

Create a zip file containing the flashfs folder tree and camera.cmd
Rename the file from .zip to .fif


Install FLIR tools
Go to the install folder\bin
Turn camera on and plug USB in
Run FLIRInstallNet
Browse to your .fif file

Click Run FIF

Unplug USB, remove battery and replace

Enjoy!


To remove hack :
Run FLIRInstallNet, choose the "Remove_hack" .fif file


USB RNDIS MODE
Do not mess with if you don't know what you're doing!
You can easily brick your camera with careless console commands
If you don't know why you may want to use RNDIS, YOU DON'T!

RNDIS allows FTP and Telnet access, and access to service mode via web interface

web/ftp/telnet 192.168.0.2 login flir, pw 3vlig

To set USB RNDIS mode temporarily - until next hard restart
Run FLIRInstallNet, run the "Set_RNDIS_Temporary" .fif file
You will get a timeout error as it dumps the USB connection.

.fif Scripts are also included to set RNDIS permanently, and also remove permanent RNDIS
These add/remove the appcore.d\factory.d\zrndis.rsc file

When RNDIS is active, USB Mass sotrage and video mode are NOT available.
Access to files is still possible via FTP or the the Flir T3Mon virtual drive util that comes with the RNDIS device drivers

Note FlirInstallNet WILL work over RNDIS.


Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on November 03, 2013, 09:11:06 am
Only needs the camera.cmd in the zip
Quote
addfile flashfs/system/appcore.d/config.d/e8.cfg


LOOOOOOL! Seriously? That is just too easy.  ;D Almost too easy.  >:D

Edit: forgot to ask, how much space is left on the flash device?

173 MB...  :=\

From my notes I have:
Code: [Select]

FLASH:
Toshiba AX1682
TAIWAN 13159AE 3
TC58NVG1S3ETA00

SLC NAND FLASH, 256 MBytes
Used 83/256 Mb, that's pretty low usage. Which is a good thing. Plenty room for some extra experimentation. :) Not strange now that I think about it, since that flash will also have to store all the images. Right? I recall Mike mentioning only 1 flash chippie, and two seperate LPDDR's (fpga + cpu).

There is _plenty_ of ways they could block this ... too many to enumerate and I wouldn't want to give them ideas ...

Yup. And I almost hope they'll try some. Preferably one of the predictable ones, because that way the solution has already been done. History, repeat.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Wann on November 03, 2013, 09:14:18 am
There is _plenty_ of ways they could block this ... too many to enumerate and I wouldn't want to give them ideas ...

I tried running this in a terminal :-/O
Code: [Select]
rm -rf http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardownDidn't work.




Ah just kidding  ^-^
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tnt on November 03, 2013, 09:20:19 am
But I'd be more interested to find out how that .exe gets a shell in the first place and if we can make a software that does it.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Wann on November 03, 2013, 09:22:06 am
..and of course you should be able to use the same method to install a custom boot screen

My new boot screen:
(http://wanngineering.com/wp-content/uploads/2013/11/behind.png)

The seat keeps the heat from my behind.  8)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 03, 2013, 09:31:28 am
But I'd be more interested to find out how that .exe gets a shell in the first place and if we can make a software that does it.
Yeah, because it's soooo hard now.. - I suppose it would be nice to avoid needing the FLIR software. Nice of them to include all the tools you need ready in the box though!

If you could get the USB comms working standalone, you could in principle do something that reads out the serial no., merges and CRC's the file and copies in a single operation.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 03, 2013, 09:49:56 am
I wonder if a similar method would work on the i series - not sure if files are in the same place
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ixfd64 on November 03, 2013, 09:51:01 am
A while ago, there was talk of a hidden menu that could be activated by a certain sequence of key presses. Has anyone found it yet?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tnt on November 03, 2013, 10:00:29 am
Yeah, because it's soooo hard now.. - I suppose it would be nice to avoid needing the FLIR software. Nice of them to include all the tools you need ready in the box though!

Well not really for the hack itself, just to be able to play and experiment with the OS. I don't want to have to use a FIF to switch it to RNDIS (then switch it back) each time I want a console.

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 03, 2013, 10:07:03 am
I'm fairly sure you can do it by putting the rndis.rsc file in \flashfs\system\appcore.d\factory.d
This file is in one of the early hack zips.

with rndis the only thing you can't do is webcam mode - you can pull your saved images via the Flir toolbar thing, or FTP
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 03, 2013, 10:12:57 am
Mike (and anyone else with an E4):

How useful would you estimate this particular camera is for taking images of PCBs, in enough detail to identify which components are getting warm (with or without the benefit of your recent work)?

Yes -
See pics on this post (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg316866/#msg316866)

The only issue at the moment is adjusting the lens for close-up focus -the lens can be adjusted without opening as it's only locked by the friction of the surrounding rubber, but it's a bit hard to grab hold of. 
 I am working on a tool to do this, as well as looking at using cheap laser cutter lenses

Looking at the moulding on the lens surround could you make a tool out of polymorph? Just soften it and push it against the lens surround.
Maybe - problem is it needs to be rigid enough to push against the outer ring, but hollow enough to not block too much field of view - currently looking at a PCB ring with pins.
Just did a quick test impression with polymorph and seems to be pretty good - just need to figure out what shape the rest needs to be to a useful tool that can be used 'blind' while looking at the screen
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Wann on November 03, 2013, 10:17:27 am
I'm fairly sure you can do it by putting the rndis.rsc file in \flashfs\system\appcore.d\factory.d
This file is in one of the early hack zips.

with rndis the only thing you can't do is webcam mode - you can pull your saved images via the Flir toolbar thing, or FTP

There is a
Code: [Select]
zlast_RNDIS.rsc in the firmware file for the FLIR iX series firmware. Could you just rename that file, or is the real RNDIS.rsc different?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 03, 2013, 10:33:54 am
I'm fairly sure you can do it by putting the rndis.rsc file in \flashfs\system\appcore.d\factory.d
This file is in one of the early hack zips.

with rndis the only thing you can't do is webcam mode - you can pull your saved images via the Flir toolbar thing, or FTP

There is a
Code: [Select]
zlast_RNDIS.rsc in the firmware file for the FLIR iX series firmware. Could you just rename that file, or is the real RNDIS.rsc different?

Attatched are .rsc files for normal and rndis.

I'm not sure what happens if you have both - my best guess is they are read alphabetically, so to do rndis without touching the existing usb.rsc you may need to rename it to something later alphabetically.

(This may explain the  zlast name above)

The files are CR32'd, so can't just be edited without re-CRCing (method a few pages earlier here)   
I did try making one that did all 3 protocols but it went a bit nuts..


BTW a reminder that the first thing you should probably to if playing is run RNDIS and use filezilla to ftp off a backup copy of the whole \flashfs structure, as this is all the data specific to your camera.


Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Wann on November 03, 2013, 10:40:50 am

Attatched are .rsc files for normal and rndis.

I'm not sure what happens if you have both - my best guess is they are read alphabetically, so to do rndis without touching the existing usb.rsc you may need to rename it to something later alphabetically.
The files are CR32'd, so can't just be edited without re-CRCing (method a few pages earlier here)   
I did try making one that did all 3 protocols but it went a bit nuts..

BTW a reminder that the first thing you should probably to if playing is run RNDIS and use filezilla to ftp off a backup copy of the whole \flashfs structure, as this is all the data specific to your camera.

So the zlast_RNDIS.rsc from the iX firmware file:
Code: [Select]
#
# USB mode MSD
#
.system entry
.system.usbmode text "RNDIS"
# CRC32 d51f0c78

and the rndis.rsc you zipped:
Code: [Select]
#
# Generated at 2000-01-08 21:43:17
# ID
#
.system entry
.system.usbmode text "UVC_MSD"
# CRC32 c37005c3

Hmm... That's the same as the usb.rsc you zipped...?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 03, 2013, 10:48:43 am
Oops - just updated zip file in above post with correct version
Quote
#
# USB mode MSD
#
.system entry
.system.usbmode text "RNDIS"
# CRC32 d51f0c78
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Wann on November 03, 2013, 11:00:17 am
(This may explain the  zlast name above)

Ahh. That makes sense.
So does the CRC checks the filename, or is removing "zlast_" via camera.cmd a possibility  :-/O

I've never worked with CRC before :-BROKE
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Wann on November 03, 2013, 11:01:22 am
So does the CRC checks the filename, or is removing "zlast_" via camera.cmd a possibility  :-/O

Nooooo. It's the same CRC32 value for both  ;D
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 03, 2013, 11:04:00 am
(This may explain the  zlast name above)

Ahh. That makes sense.
So does the CRC checks the filename, or is removing "zlast_" via camera.cmd a possibility  :-/O

I've never worked with CRC before :-BROKE
No - it reads all files in the config.d for .cfg and factory.d for .rsc files
Each file must have a valid CRC otherwise it is ignored.

I'm assuming, but not 100% confirmed, that it reads files in alphabetical order, and options in later files override any in earlier files.
.rsc files have CRC32 and are portable between units
.cfg files have CRC01 and include the unit serial number and so are specific to a particular camera.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Wann on November 03, 2013, 11:15:30 am
No - it reads all files in the config.d for .cfg and factory.d for .rsc files
Each file must have a valid CRC otherwise it is ignored.

I'm assuming, but not 100% confirmed, that it reads files in alphabetical order, and options in later files override any in earlier files.
.rsc files have CRC32 and are portable between units
.cfg files have CRC01 and include the unit serial number and so are specific to a particular camera.

So the rndis.rsc you showed has the CRC32:
Code: [Select]
# CRC32 d51f0c78
and the zlast_RNDIS.rsc from the iX firmware file:
Code: [Select]
# CRC32 d51f0c78
That must mean  :-/O on the filename  :-//

Any brave volunteer with an i3?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 03, 2013, 11:20:24 am
Actually I vaguely recall that the  i3 already has a known way to do rndis from the keypad - take a look a few pages back.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Wann on November 03, 2013, 11:23:54 am
Actually I vaguely recall that the  i3 already has a known way to do rndis from the keypad - take a look a few pages back.

Yes you're right.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: olsenn on November 03, 2013, 12:22:16 pm
Can someone post a screenshot from the E4 (prior to applying the hack) and the same shot after the hack has been applied? I'd like to see the difference an increase in resolution makes.

Also, since I noticed that there's been a lot of talk about firmware and crc checks etc. has there been any new progress on this hack? I am under the impression that the E4 can now become an E8 without opening it up?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Wann on November 03, 2013, 01:08:06 pm
Can someone post a screenshot from the E4 (prior to applying the hack) and the same shot after the hack has been applied? I'd like to see the difference an increase in resolution makes.

Maybe I can take some in the morning.

Also, since I noticed that there's been a lot of talk about firmware and crc checks etc. has there been any new progress on this hack? I am under the impression that the E4 can now become an E8 without opening it up?

See post #524  :P
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nova1200 on November 03, 2013, 01:36:39 pm
It works!! Fantastic sleuthing everyone!
Here is a pair of images, not quite from the same perspective, but close. Before:
(http://i.imgur.com/xA3xgQG.jpg)
After:
(http://i.imgur.com/giQuGFn.jpg)

This was on a just-purchased E4 (another sales commission for Mike) with firmware 1.18.7.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: kaz911 on November 03, 2013, 02:52:21 pm
here is a link to the 1.18.7 firmware http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_ex_pn639_v1.18.7_update_pack.zip (http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_ex_pn639_v1.18.7_update_pack.zip)

can someone test if you can downgrade? (Only do if you have the later firmware of course) :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 03, 2013, 08:22:07 pm
Earlier hack works 1.18.7 - latest hack uses same file - only difference is how the file gets there, so no reason to think it won't work.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Zoltan von Negrow on November 03, 2013, 09:29:49 pm


At a PC command prompt, run

  CRC01 E8.cfg (on the edited file)

This will display a line in the form
# CRC01 xxxxxxxx



I can´t make crc in cmd, how exactly i have to make this?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Wann on November 03, 2013, 09:31:36 pm
You'll have to run it from the folder containing e8.cfg and CRC01.exe.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Zoltan von Negrow on November 03, 2013, 09:41:59 pm
You'll have to run it from the folder containing e8.cfg and CRC01.exe.

No, I need run it on win pc (unfortunately i haven´t), I have to go to my wife´s PC, a nd try it there.


Yes, it works on win.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 03, 2013, 09:45:57 pm
Another essential mod....
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Zoltan von Negrow on November 03, 2013, 09:47:14 pm
Another essential mod....


 :-DD :-+
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Wann on November 03, 2013, 09:48:21 pm
Another essential mod....

 :-DD

Yeah. Definitely gonna fool FLIR on that one.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: PA0PBZ on November 03, 2013, 10:02:08 pm
Another essential mod....

I wonder if we can order the glass as a spare...
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 03, 2013, 10:17:22 pm
Another essential mod....

I wonder if we can order the glass as a spare...
..well _if_ the E8 has a better lens, I would think spare lenses are a reasonable thing to be able to get as spares due to possible damage. Could look odd if they get more orders for E8 lenses than they've sold E8's They might want the unit's serial number though.

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 03, 2013, 10:21:43 pm
Now, finally its time for the mod.
I am just downloading the Flir tools and due to my slow internet connection it will take another 15 minutes.

In the meantime I have one last question because I do not want to mix anything up later:
1) If all the steps described in e4hack3.zip are done .... how can one set the system back (reset) to the original state (80x60)? Probably just replacing the original e8.cfg file, am I correct?

2) I recognised, that the pictures you uploaded are showing (in EXIF informations) the serial number and "E4" as the model number. Is it possible to change the 'E4' in the Exif information of the saved images to 'E8' by default? What about the serial?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 03, 2013, 10:44:51 pm
Now, finally its time for the mod.
I am just downloading the Flir tools and due to my slow internet connection it will take another 15 minutes.

In the meantime I have one last question because I do not want to mix anything up later:
1) If all the steps described in e4hack3.zip are done .... how can one set the system back (reset) to the original state (80x60)? Probably just replacing the original e8.cfg file, am I correct?
There is no original e8.cfg - this is an additional file which overrides the unit's default conf.cfg file.
To revert you need to delete e8.cfg - easiest way is to create another .fif containing a camera.cmd script that deletes it:
delfile flashfs/system/appcore.d/config.d/e8.cfg


Quote
2) I recognised, that the pictures you uploaded are showing (in EXIF informations) the serial number and "E4" as the model number. Is it possible to change the 'E4' in the Exif information of the saved images to 'E8' by default? What about the serial?
Don't know. E4 and serial number are in the eeprom so probably gets it from there. I've not investigated modding this but it could be done from the console (over serial or RNDIS) using the I2C command. It is checksummed but it's a simple 16 bit addition - details are earlier in this thread.

 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: bookaboo on November 03, 2013, 11:02:08 pm
Just attempting the mod now. I've created the CRC01 code and modified the E8.cfg file, I saved this file in the Flashfs folder, zipped the folder and renamed as Flashfs.fif.
However flirinstallnet.exe doesnt seem to recognise my *.fif file, The "Run Fif" box is shaded and theres a message (IDS_FILE_FORMAT_ERROR)

Output from the log :
2013-11-03 11:57:16,0917 005972 * ************************************************************************************************************************
2013-11-03 11:57:16,0917 005972 * ********************************************************* FIF **********************************************************
2013-11-03 11:57:16,0917 005972 * ************************************************************************************************************************
2013-11-03 11:57:16,0917 005972 * * SW build date: Aug 29 2013 11:18:40.
2013-11-03 11:57:16,0917 005972 * FIFInstallerEngine created
2013-11-03 11:57:16,0918 005972 * Command line arg 0 -> C:\Program Files (x86)\FLIR Systems\FLIR Tools\bin\FLIRInstallNet.exe
2013-11-03 11:57:16,0918 005972 * Running in batch mode: NO
2013-11-03 11:57:22,0345 005972 * Installation file is C:\Users\Laptop\Desktop\e4hack3\Flashfs.fif
2013-11-03 11:57:22,0349 005972 * START file list
2013-11-03 11:57:22,0350 005972 * Flashfs/system/appcore.d/config.d/E8.cfg
2013-11-03 11:57:22,0355 005972 * END file list
2013-11-03 11:57:22,0356 005972 * Missing camera macro file

Code: [Select]
#
# Generated at 2013-06-12 14:30:34
#
.caps entry
.caps.config entry
.caps.config.name text "app E8"
.caps.config.revision text "1.0"
.caps.config.image entry
.caps.config.image.framegrab entry
.caps.config.image.framegrab.fusion entry
.caps.config.image.framegrab.fusion.enabled bool true
.caps.config.image.framegrab.fusion.pip entry
.caps.config.image.framegrab.fusion.pip.enabled bool true
.caps.config.image.framegrab.fusion.hcf entry
.caps.config.image.framegrab.fusion.hcf.enabled bool true
.caps.config.image.services entry
.caps.config.image.services.store entry
.caps.config.image.services.store.enabled bool true
.caps.config.image.services.store.radiometric entry
.caps.config.image.services.store.radiometric.enabled bool true
.caps.config.image.services.store.incompatible entry
.caps.config.image.services.store.incompatible.enabled bool false
.caps.config.image.services.store.incompatible.level int32 0
.caps.config.image.settings entry
.caps.config.image.settings.enabled bool true
.caps.config.image.settings.IRwidth int32 320
.caps.config.image.settings.IRheight int32 240
.caps.config.image.sysimg entry
.caps.config.image.sysimg.alarms entry
.caps.config.image.sysimg.alarms.enabled bool true
.caps.config.image.sysimg.alarms.measfunc entry
.caps.config.image.sysimg.alarms.measfunc.enabled bool true
.caps.config.image.sysimg.alarms.measfunc.maxCount int32 3
.caps.config.image.sysimg.alarms.humidity entry
.caps.config.image.sysimg.alarms.humidity.enabled bool true
.caps.config.image.sysimg.alarms.humidity.maxCount int32 1
.caps.config.image.sysimg.alarms.insulation entry
.caps.config.image.sysimg.alarms.insulation.enabled bool true
.caps.config.image.sysimg.alarms.insulation.maxCount int32 1
.caps.config.image.sysimg.irMarkers entry
.caps.config.image.sysimg.irMarkers.enabled bool true
.caps.config.image.sysimg.irMarkers.spot entry
.caps.config.image.sysimg.irMarkers.spot.enabled bool false
.caps.config.image.sysimg.irMarkers.spot.maxCount int32 0
.caps.config.image.sysimg.irMarkers.arrow entry
.caps.config.image.sysimg.irMarkers.arrow.enabled bool true
.caps.config.image.sysimg.irMarkers.arrow.maxCount int32 4
.caps.config.image.sysimg.irMarkers.box entry
.caps.config.image.sysimg.irMarkers.box.enabled bool false
.caps.config.image.sysimg.irMarkers.box.maxCount int32 0
.caps.config.image.sysimg.measureFuncs entry
.caps.config.image.sysimg.measureFuncs.enabled bool true
.caps.config.image.sysimg.measureFuncs.diff entry
.caps.config.image.sysimg.measureFuncs.diff.enabled bool true
.caps.config.image.sysimg.measureFuncs.diff.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.diff.calcMask int32 65526
.caps.config.image.sysimg.measureFuncs.isotherm entry
.caps.config.image.sysimg.measureFuncs.isotherm.enabled bool true
.caps.config.image.sysimg.measureFuncs.isotherm.calcMask int32 20
.caps.config.image.sysimg.measureFuncs.isotherm.dual bool false
.caps.config.image.sysimg.measureFuncs.isotherm.fixScale bool false
.caps.config.image.sysimg.measureFuncs.isotherm.interval bool true
.caps.config.image.sysimg.measureFuncs.isotherm.invInterval bool false
.caps.config.image.sysimg.measureFuncs.isotherm.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.mbox entry
.caps.config.image.sysimg.measureFuncs.mbox.enabled bool true
.caps.config.image.sysimg.measureFuncs.mbox.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mbox.maxCount int32 5
.caps.config.image.sysimg.measureFuncs.mcircle entry
.caps.config.image.sysimg.measureFuncs.mcircle.enabled bool false
.caps.config.image.sysimg.measureFuncs.mcircle.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mcircle.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.mline entry
.caps.config.image.sysimg.measureFuncs.mline.enabled bool false
.caps.config.image.sysimg.measureFuncs.mline.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mline.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.reftemp entry
.caps.config.image.sysimg.measureFuncs.reftemp.enabled bool true
.caps.config.image.sysimg.measureFuncs.reftemp.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.reftemp.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.script entry
.caps.config.image.sysimg.measureFuncs.script.enabled false
.caps.config.image.sysimg.measureFuncs.script.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.spot entry
.caps.config.image.sysimg.measureFuncs.spot.enabled bool true
.caps.config.image.sysimg.measureFuncs.spot.calcMask int32 514
.caps.config.image.sysimg.measureFuncs.spot.maxCount int32 5
.caps.config.image.sysimg.visualMarkers entry
.caps.config.image.sysimg.visualMarkers.enabled bool true
.caps.config.image.sysimg.visualMarkers.spot entry
.caps.config.image.sysimg.visualMarkers.spot.enabled bool false
.caps.config.image.sysimg.visualMarkers.spot.maxCount int32 0
.caps.config.image.sysimg.visualMarkers.arrow entry
.caps.config.image.sysimg.visualMarkers.arrow.enabled bool true
.caps.config.image.sysimg.visualMarkers.arrow.maxCount int32 4
.caps.config.image.sysimg.visualMarkers.box entry
.caps.config.image.sysimg.visualMarkers.box.enabled bool false
.caps.config.image.sysimg.visualMarkers.box.maxCount int32 0
.caps.config.image.contadj entry
.caps.config.image.contadj.minSpanFactor entry
.caps.config.image.contadj.minSpanFactor.enabled bool true
.caps.config.image.contadj.minSpanFactor.factorAuto double 2.0
.caps.config.image.contadj.minSpanFactor.factorManual double 2.0
.caps.config.image.targetNoise entry
.caps.config.image.targetNoise.enabled bool true
.caps.config.image.targetNoise.targetNoiseMk int32 5
.caps.config.image.zoom entry
.caps.config.image.zoom.enabled bool false
.caps.config.image.zoom.maxFactor double 8
.caps.config.system entry
.caps.config.system.focus entry
.caps.config.system.focus.laser entry
.caps.config.system.focus.laser.updateFocus entry
.caps.config.system.focus.laser.updateFocus.enabled bool true
.caps.config.ui entry
.caps.config.ui.fusion entry
.caps.config.ui.fusion.PIP entry
.caps.config.ui.fusion.PIP.enabled bool true
.caps.hw entry
.caps.hw.sdcard entry
.caps.hw.sdcard.enabled bool false
# ID 63905206
# CRC01 1919a42b


Notes:
- One blank line at the bottom of E8.cfg
- I edited the cfg in notepad
- I'm running windows 7 professional 64bit


Any ideas?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: equinoxe on November 03, 2013, 11:06:43 pm
Just attempting the mod now. I've created the CRC01 code and modified the E8.cfg file, I saved this file in the Flashfs folder, zipped the folder and renamed as Flashfs.fif.
However flirinstallnet.exe doesnt seem to recognise my *.fif file, The "Run Fif" box is shaded and theres a message (IDS_FILE_FORMAT_ERROR)

Output from the log :
2013-11-03 11:57:16,0917 005972 * ************************************************************************************************************************
2013-11-03 11:57:16,0917 005972 * ********************************************************* FIF **********************************************************
2013-11-03 11:57:16,0917 005972 * ************************************************************************************************************************
2013-11-03 11:57:16,0917 005972 * * SW build date: Aug 29 2013 11:18:40.
2013-11-03 11:57:16,0917 005972 * FIFInstallerEngine created
2013-11-03 11:57:16,0918 005972 * Command line arg 0 -> C:\Program Files (x86)\FLIR Systems\FLIR Tools\bin\FLIRInstallNet.exe
2013-11-03 11:57:16,0918 005972 * Running in batch mode: NO
2013-11-03 11:57:22,0345 005972 * Installation file is C:\Users\Laptop\Desktop\e4hack3\Flashfs.fif
2013-11-03 11:57:22,0349 005972 * START file list
2013-11-03 11:57:22,0350 005972 * Flashfs/system/appcore.d/config.d/E8.cfg
2013-11-03 11:57:22,0355 005972 * END file list
2013-11-03 11:57:22,0356 005972 * Missing camera macro file

Code: [Select]
#
# Generated at 2013-06-12 14:30:34
#
.caps entry
.caps.config entry
.caps.config.name text "app E8"
.caps.config.revision text "1.0"
.caps.config.image entry
.caps.config.image.framegrab entry
.caps.config.image.framegrab.fusion entry
.caps.config.image.framegrab.fusion.enabled bool true
.caps.config.image.framegrab.fusion.pip entry
.caps.config.image.framegrab.fusion.pip.enabled bool true
.caps.config.image.framegrab.fusion.hcf entry
.caps.config.image.framegrab.fusion.hcf.enabled bool true
.caps.config.image.services entry
.caps.config.image.services.store entry
.caps.config.image.services.store.enabled bool true
.caps.config.image.services.store.radiometric entry
.caps.config.image.services.store.radiometric.enabled bool true
.caps.config.image.services.store.incompatible entry
.caps.config.image.services.store.incompatible.enabled bool false
.caps.config.image.services.store.incompatible.level int32 0
.caps.config.image.settings entry
.caps.config.image.settings.enabled bool true
.caps.config.image.settings.IRwidth int32 320
.caps.config.image.settings.IRheight int32 240
.caps.config.image.sysimg entry
.caps.config.image.sysimg.alarms entry
.caps.config.image.sysimg.alarms.enabled bool true
.caps.config.image.sysimg.alarms.measfunc entry
.caps.config.image.sysimg.alarms.measfunc.enabled bool true
.caps.config.image.sysimg.alarms.measfunc.maxCount int32 3
.caps.config.image.sysimg.alarms.humidity entry
.caps.config.image.sysimg.alarms.humidity.enabled bool true
.caps.config.image.sysimg.alarms.humidity.maxCount int32 1
.caps.config.image.sysimg.alarms.insulation entry
.caps.config.image.sysimg.alarms.insulation.enabled bool true
.caps.config.image.sysimg.alarms.insulation.maxCount int32 1
.caps.config.image.sysimg.irMarkers entry
.caps.config.image.sysimg.irMarkers.enabled bool true
.caps.config.image.sysimg.irMarkers.spot entry
.caps.config.image.sysimg.irMarkers.spot.enabled bool false
.caps.config.image.sysimg.irMarkers.spot.maxCount int32 0
.caps.config.image.sysimg.irMarkers.arrow entry
.caps.config.image.sysimg.irMarkers.arrow.enabled bool true
.caps.config.image.sysimg.irMarkers.arrow.maxCount int32 4
.caps.config.image.sysimg.irMarkers.box entry
.caps.config.image.sysimg.irMarkers.box.enabled bool false
.caps.config.image.sysimg.irMarkers.box.maxCount int32 0
.caps.config.image.sysimg.measureFuncs entry
.caps.config.image.sysimg.measureFuncs.enabled bool true
.caps.config.image.sysimg.measureFuncs.diff entry
.caps.config.image.sysimg.measureFuncs.diff.enabled bool true
.caps.config.image.sysimg.measureFuncs.diff.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.diff.calcMask int32 65526
.caps.config.image.sysimg.measureFuncs.isotherm entry
.caps.config.image.sysimg.measureFuncs.isotherm.enabled bool true
.caps.config.image.sysimg.measureFuncs.isotherm.calcMask int32 20
.caps.config.image.sysimg.measureFuncs.isotherm.dual bool false
.caps.config.image.sysimg.measureFuncs.isotherm.fixScale bool false
.caps.config.image.sysimg.measureFuncs.isotherm.interval bool true
.caps.config.image.sysimg.measureFuncs.isotherm.invInterval bool false
.caps.config.image.sysimg.measureFuncs.isotherm.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.mbox entry
.caps.config.image.sysimg.measureFuncs.mbox.enabled bool true
.caps.config.image.sysimg.measureFuncs.mbox.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mbox.maxCount int32 5
.caps.config.image.sysimg.measureFuncs.mcircle entry
.caps.config.image.sysimg.measureFuncs.mcircle.enabled bool false
.caps.config.image.sysimg.measureFuncs.mcircle.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mcircle.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.mline entry
.caps.config.image.sysimg.measureFuncs.mline.enabled bool false
.caps.config.image.sysimg.measureFuncs.mline.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mline.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.reftemp entry
.caps.config.image.sysimg.measureFuncs.reftemp.enabled bool true
.caps.config.image.sysimg.measureFuncs.reftemp.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.reftemp.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.script entry
.caps.config.image.sysimg.measureFuncs.script.enabled false
.caps.config.image.sysimg.measureFuncs.script.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.spot entry
.caps.config.image.sysimg.measureFuncs.spot.enabled bool true
.caps.config.image.sysimg.measureFuncs.spot.calcMask int32 514
.caps.config.image.sysimg.measureFuncs.spot.maxCount int32 5
.caps.config.image.sysimg.visualMarkers entry
.caps.config.image.sysimg.visualMarkers.enabled bool true
.caps.config.image.sysimg.visualMarkers.spot entry
.caps.config.image.sysimg.visualMarkers.spot.enabled bool false
.caps.config.image.sysimg.visualMarkers.spot.maxCount int32 0
.caps.config.image.sysimg.visualMarkers.arrow entry
.caps.config.image.sysimg.visualMarkers.arrow.enabled bool true
.caps.config.image.sysimg.visualMarkers.arrow.maxCount int32 4
.caps.config.image.sysimg.visualMarkers.box entry
.caps.config.image.sysimg.visualMarkers.box.enabled bool false
.caps.config.image.sysimg.visualMarkers.box.maxCount int32 0
.caps.config.image.contadj entry
.caps.config.image.contadj.minSpanFactor entry
.caps.config.image.contadj.minSpanFactor.enabled bool true
.caps.config.image.contadj.minSpanFactor.factorAuto double 2.0
.caps.config.image.contadj.minSpanFactor.factorManual double 2.0
.caps.config.image.targetNoise entry
.caps.config.image.targetNoise.enabled bool true
.caps.config.image.targetNoise.targetNoiseMk int32 5
.caps.config.image.zoom entry
.caps.config.image.zoom.enabled bool false
.caps.config.image.zoom.maxFactor double 8
.caps.config.system entry
.caps.config.system.focus entry
.caps.config.system.focus.laser entry
.caps.config.system.focus.laser.updateFocus entry
.caps.config.system.focus.laser.updateFocus.enabled bool true
.caps.config.ui entry
.caps.config.ui.fusion entry
.caps.config.ui.fusion.PIP entry
.caps.config.ui.fusion.PIP.enabled bool true
.caps.hw entry
.caps.hw.sdcard entry
.caps.hw.sdcard.enabled bool false
# ID 63905206
# CRC01 1919a42b


Notes:
- One blank line at the bottom of E8.cfg
- I edited the cfg in notepad
- I'm running windows 7 professional 64bit


Any ideas?

Did you add the camera.cmd file?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 03, 2013, 11:11:22 pm
Quote
2013-11-03 11:57:22,0356 005972 * Missing camera macro file
Forgot to put the camera.cmd in the (root of the) zip..?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: bookaboo on November 03, 2013, 11:12:56 pm
Doh! Reading comprehension fail.
Does it matter what I call the file in this case?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 03, 2013, 11:14:05 pm
Doh! Reading comprehension fail.
Does it matter what I call the file in this case?
Doesn't matter what the zip (fif) file is called - just browse to it
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 03, 2013, 11:28:11 pm
There is no original e8.cfg - this is an additional file which overrides the unit's default conf.cfg file.
To revert you need to delete e8.cfg - easiest way is to create another .fif containing a camera.cmd script that deletes it:
delfile flashfs/system/appcore.d/config.d/e8.cfg
Works perfectly. Thanks
Attached is the corresponding .fif file which can be used by others (unzip and place in any folder).
Peter
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: 0xdeadbeef on November 03, 2013, 11:28:37 pm
Damn it guys. This forum will be my ruin.
Any plausible reasons why someone (who is not into power electronics or thermal insulation) would need a thermal camera ;) ?
I mean, for sure I want one at least since I saw Predator back in the eighties, but admittedly merely as a tech toy.
Indeed I recently began investigating in thermopile arrays to build my own cheap substitute, but with a 320x240 9Hz camera in reach, this doesn't seem so interesting any more.
So now, thanks to you, I'm struggling with myself whether to resist my geek desire to waste 1200€ for something I will be fascinated with for the first week and then put it in the shelf.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: bookaboo on November 03, 2013, 11:30:24 pm
I *think* I got the file updated but there appears to be no difference to the E4 after a bremoving battery and powering up.
Got the message


Received shell command message:
FLIR Command Line Interpreter
Version 0.4.3 running on WinCE 6.0

\>
Connected
Installation started...
Adding flashfs/system/appcore.d/config.d/e8.cfg
Camera update completed

Ok




Not sure where Im going wrong here.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: BravoV on November 03, 2013, 11:36:31 pm
Damn it guys. This forum will be my ruin.

...

So now, thanks to you, I'm struggling with myself whether to resist my geek desire to waste 1200€ for something I will be fascinated with for the first week and then put it in the shelf.

Experiencing same feeling here, while fully aware that I DO NOT need it at all.  :palm:

This forum is evil.  >:D
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 03, 2013, 11:52:02 pm
I *think* I got the file updated but there appears to be no difference to the E4 after a bremoving battery and powering up.
Got the message


Received shell command message:
FLIR Command Line Interpreter
Version 0.4.3 running on WinCE 6.0

\>
Connected
Installation started...
Adding flashfs/system/appcore.d/config.d/e8.cfg
Camera update completed

Ok




Not sure where Im going wrong here.
Probably an error in creating the e8.cfg file  - wrong serial, wrong crc, "CRC" in lower case, spurious linefeeds etc. Or you copied the template one without the crc from the wrong place.

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: bookaboo on November 04, 2013, 12:19:22 am
Yep, I got myself into a muddle with various e8.cfg files, one of which was missing the blank bottom line. Unfortunately this was the one Command Prompt kept going to!  :palm:

Up and running now so off to have some fun, I'll upload some before/after pics tomorrow.
Thanks Mike & Co. !!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Zoltan von Negrow on November 04, 2013, 12:25:28 am
I have to confirm that hack works on 1.19.8, so no worries about that firmware, it´s not anti-hack firmware. :-+
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on November 04, 2013, 01:21:18 am
I have to confirm that hack works on 1.19.8, so no worries about that firmware, it´s not anti-hack firmware. :-+

Awww.  :-\

So have you or any of the 1.18.8 owners noticed any diffs when comparing files on your E4 to the files in the 1.18.7 zip?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: AndyC_772 on November 04, 2013, 01:23:48 am
Any plausible reasons why someone (who is not into power electronics or thermal insulation) would need a thermal camera ;) ?
I mean, for sure I want one at least since I saw Predator back in the eighties, but admittedly merely as a tech toy.

Good question - hopefully putting a decent TIC into the hands of some people outside the traditional markets will result in some good ideas, and maybe an expansion of the market for TICs generally.

The same thing happened with digital storage scopes, after all... they weren't always a piece of equipment which an enthusiast could buy as a standard item along with a multimeter and soldering iron, but now even the most basic bench seems to have a Rigol 1052E on it. I'm sure it's no coincidence that this particular model was also easy to upgrade with a simple hack.

Obviously if you really needed a TIC, you'd have an application in mind already, but here's a few idle thoughts for stuff you could do...

Domestic stuff:

- check round your home for draughts, poor insulation, electrical items taking significant power

- check just how well your fridge, freezer, boiler and/or A/C are working. Are your radiators working effectively? Is the system well balanced, or are some being starved of hot water?

- home security - maybe you could reliably identify when someone is on your property, and use it to turn on the floodlights or wake the dog? There could be some interesting work to do with the real-time video feed that's available.

Electronics stuff:

- new board? Point the TIC at it when you power it up for the first time. If any components highlight themselves unexpectedly in the thermal image, switch off straight away before something gets fried.

- short circuit between power and ground? Could be anywhere, but the TIC can highlight the location of the short in moments.

- anything involving power supplies, heat sinks, fans and so on, obviously.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: bookaboo on November 04, 2013, 01:39:10 am
I already unexpectedly found a small leak in my workshop roof with the pre-modded E4.
It's not even dripping water yet but its letting damp onto the purlin, easy fix next time im up instead of a nasty surprise.

I justified the purchase for EE/Repair work, there might even be a market locally for some sort of industrial Thermography. I'll have to look into the situation regarding qualifications and regulations though.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: madpuma13 on November 04, 2013, 01:46:40 am
Around the house these can and are used to identify potential problems.

You can find water leaks in your walls or roof.

Poorly installed insulation or lack of insulation

Drafts in windows

Appliance checking

Identify termite infestations

Identify mold/rot problems

So many possibilities!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on November 04, 2013, 01:56:04 am
The thermal camera opens up a world to us that is otherwise invisible. That alone makes them very cool pieces of equipment  8)

There are many uses for such a device and owners will discover many of them by experimentation or some research on the internet will give you some ideas. In its simplest form it is an accurate IR thermometer that may be used at a distance from the target.

These cameras are even finding uses in art.

At the risk of offending the more sensitive readership, as ladies bits are shown, take a look here :

a hot thermal morning with a woman, thermal art (http://www.youtube.com/watch?v=yv2Bq_EFg4c#ws)



With regard to using the E4 (E8) for any serious Thermography applications, be aware that it is limited in terms of manual configuration. It has no manual centre temperature and span capability which is an essential part of industrial thermography.  Also, using a hacked E4 would invalidate any claimed calibration on the survey.

I suggest owners enjoy their upgraded E4's for what they are....a bargain priced medium resolution thermal camera for consumer applications.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: olsenn on November 04, 2013, 02:12:10 am
What camera was used to make that video? Does the E4 have that capability (video recording)? I realize it would only be 320x240@9Hz if anything
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on November 04, 2013, 02:39:39 am
I only know that it was a TESTO thermal camera. Resolution not known but refresh rate is decent so not a 9Hz model.

E series cameras capture video via a PC and would be challenged to produce a real time video such as shown.

My FLIR PM695 cannot do real time video either so I have to capture S-Video or composite video  from its video output port using a USB video capture unit or my Archos 505 media unit.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: firewire on November 04, 2013, 02:50:24 am
Great videos, great thread, amazing hack!!!!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: SeanB on November 04, 2013, 03:54:32 am
Was looking at the prices at RS and the base model Testo is the price of a reasonable used car here.....
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ixfd64 on November 04, 2013, 04:56:35 am
Damn it guys. This forum will be my ruin.
Any plausible reasons why someone (who is not into power electronics or thermal insulation) would need a thermal camera ;) ?
I mean, for sure I want one at least since I saw Predator back in the eighties, but admittedly merely as a tech toy.

I can think of several situations in which a non-inspector would find a thermal imaging camera useful:

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: PA0PBZ on November 04, 2013, 05:35:17 am
I can think of several situations in which a non-inspector would find a thermal imaging camera useful:

Creating weird avatars?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Corporate666 on November 04, 2013, 05:43:45 am
Damn it guys. This forum will be my ruin.
Any plausible reasons why someone (who is not into power electronics or thermal insulation) would need a thermal camera ;) ?
I mean, for sure I want one at least since I saw Predator back in the eighties, but admittedly merely as a tech toy.
Indeed I recently began investigating in thermopile arrays to build my own cheap substitute, but with a 320x240 9Hz camera in reach, this doesn't seem so interesting any more.
So now, thanks to you, I'm struggling with myself whether to resist my geek desire to waste 1200€ for something I will be fascinated with for the first week and then put it in the shelf.

Having bought a TIC about a year or so ago, I no longer think of it so much as a TIC or a tool for power electronics, I think of it more as a diagnostic tool like an O-scope.  An O-Scope lets you see changing signals over time that you would not otherwise see. A TIC lets you see temperature you would not otherwise see.

The TIC gets used a lot more than I thought it would.  It is one of the best diagnostic tools around.

Had a problem with one of the machines at work - got the TIC out and noticed an overheating relay.  Turned a multi-hour diagnostic chore into a 5 minute affair.

When reworking boards, I use the TIC before I even use the o-scope.  The TIC is a quick way to see obvious failures before delving into deeper diagnostics.

TIC is awesome for verifying designs.  Let's say you use a 1A linear regulator and your circuit averages 250mA but peaks at 500mA, and goes in a plastic enclosure.  Do you need a heat sink?  You could run calculations, you could use a thermocouple, but loading up your device in worst possible scenario and looking at it via the TIC tells you much more.

Intermittent failure on a circuit?  Use the TIC to find out what is going on, even after it already occured.  Easy to see things like a component on it's way to failure or a component temporarily running outside it's specified range.

I diagnosed a faulty wheel bearing on a car with the TIC.  It was really easy to see how much hotter it was than the other wheel bearings.  Caught it before it became a much more expensive repair.

Found a huge wasps nest in my brother in laws house that he didn't even know about.  The drywall was so thin they were almost in the home.  With a 1 year old kid in the house who would have easily pushed right through the soft spot in the wall, it was lucky we caught it in time.

There are also uses in other fields that are more specific.  I sold my i7 to a lady who uses the TIC for fitting horse saddles.  By analyzing the hot spots she can gauge fitment.

A veterinarian I know uses a TIC to check animals - easy to see things like ear and toot infections and other such stuff, when you have an animal that can't tell you what's wrong.

Then you have all the standard TIC uses... checking your home insulation, checking pipe insulation, checking doors/windows/garage, checking circuit breakers and wiring, using the TIC to find wall studs, etc. 

I say a TIC is getting to the point where it's almost a must-have tool for a serious electronics person.  For under $1,000 and 320x240 resolution and the ability to close-focus, it's a no-brainer.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: edavid on November 04, 2013, 05:57:37 am
What's the best deal on the E4 in the US these days?

(UPDATE: I found Tequipment.NET to be very responsive, and they beat the best price I found elsewhere.  Very nice deal.)

P.S. If it hasn't been mentioned before, FLIR has this freebie offer going... the borescope might be useful: http://www.distributoraccess.com/promotions/forms/FLIR-Q4a-2013-Redemption-Form.pdf (http://www.distributoraccess.com/promotions/forms/FLIR-Q4a-2013-Redemption-Form.pdf)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: 0xdeadbeef on November 04, 2013, 05:59:53 am
If it was under $1000 I would not argue. But the cheapest price over here is ~1150€ including VAT.
Anyway, I'm more or less hooked ;)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 04, 2013, 06:07:17 am
When I was looking in the UK I didn't see anyone anywhere offering anything less than the "standard" price of £796 (+VAT) - I think Flir have fairly tight control over reseller prices, but it may be worth trying to haggle - sometimes dealers with pressure to not openly discount can be persuaded to throw in a case or free shipping etc.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: coconut on November 04, 2013, 06:20:44 am
I bought my E4 last week from http://www.test-meter.co.uk/index.php/electricians-forums-discount (http://www.test-meter.co.uk/index.php/electricians-forums-discount), with the 5% discount it was just under £908.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: plesa on November 04, 2013, 06:23:07 am
If it was under $1000 I would not argue. But the cheapest price over here is ~1150€ including VAT.
Anyway, I'm more or less hooked ;)

I just try to buy one
http://www.tester.co.uk/flir-e4-thermal-imaging-camera (http://www.tester.co.uk/flir-e4-thermal-imaging-camera)
and decided to buy it in US. For camera and case it was 1035 USD, which is reasonable.

Mike, thanks for your work!!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: 0xdeadbeef on November 04, 2013, 06:30:16 am
I thought there were export restriction. E.g. mouser doesn't sell it. Then again, export restrictions from the US to Europe for a product that comes from Europe is kinda weird, but still they seem to apply.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: firewire on November 04, 2013, 06:39:25 am
What's the best deal on the E4 in the US these days?

P.S. If it hasn't been mentioned before, FLIR has this freebie offer going... the borescope might be useful: http://www.distributoraccess.com/promotions/forms/FLIR-Q4a-2013-Redemption-Form.pdf (http://www.distributoraccess.com/promotions/forms/FLIR-Q4a-2013-Redemption-Form.pdf)

USA places that have a "request a quote" after the $995 price generally will come off a $100 down to $895.  I'm sure $995 is a FLIR MAP policy (minimum advertised price).
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 04, 2013, 06:55:07 am
.. and don't forget if you're on a tight budget, dealers will be desperate to offload any stock of i3's
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: 0xdeadbeef on November 04, 2013, 07:02:23 am
The i3 is however not 100% confirmed to be hackable. Anway: what would be the maximum resolution a hacked i3 could offer on the display or in webcam mode? The i7 has 140x140 (or maybe 160x160 in the new model?), so I guess that's all we could expect even if the sensor might have a higher resolution, right?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 04, 2013, 07:10:23 am
The i3 is however not 100% confirmed to be hackable. Anway: what would be the maximum resolution a hacked i3 could offer on the display or in webcam mode? The i7 has 140x140 (or maybe 160x160 in the new model?), so I guess that's all we could expect even if the sensor might have a higher resolution, right?
I think it is - to 120x120, the display being the limit AFAIR. Obviously not as good as the E4, but could be significantly cheaper if dealers are trying to clear them out, as even with no hacks they compare poorly to the E4.
Someone commented that Farnell was stopping carrying Flir products and was open to offers - they have 5 i3's left (was 8 last week)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: G0HZU on November 04, 2013, 07:23:36 am
I'm certainly interested in this... :)

At work I have been using an Irisys 4010 TC for the last 5 years or so for thermal analysis of new and faulty PCB designs.
I think it has 160x120 resolution and manual focus and is pretty good for SMD stuff and can focus down to a few inches. It has proved to be a really useful tool with a large display. However, they were very expensive at the time. I've been looking to buy one used but this hack by Mike has changed my plan :)

I'm now very tempted to buy an E4 and I'm quite happy to pay full RRP so I just need to find someone with genuine stock for fast delivery. I am hopelessly impatient when I order things so I'd want to buy one ex stock on next day delivery. Any advice on a reliable retailer?

Also, can I ask if the camera can be hooked up to a notebook via USB to show the image in real time? I'm not sure I'd want to be using the inbuilt screen for long periods plus I would like to capture images easily this way.

Does it have a tripod thread?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 04, 2013, 08:02:39 am
I'm certainly interested in this... :)

At work I have been using an Irisys 4010 TC for the last 5 years or so for thermal analysis of new and faulty PCB designs.
I think it has 160x120 resolution and manual focus and is pretty good for SMD stuff and can focus down to a few inches. It has proved to be a really useful tool with a large display. However, they were very expensive at the time. I've been looking to buy one used but this hack by Mike has changed my plan :)

I'm now very tempted to buy an E4 and I'm quite happy to pay full RRP so I just need to find someone with genuine stock for fast delivery. I am hopelessly impatient when I order things so I'd want to buy one ex stock on next day delivery. Any advice on a reliable retailer?
I got mine from Pass/Tester & came from stock - not sure I believe their stock status on the website as I couldn't find anything not showing in stock
Quote
Also, can I ask if the camera can be hooked up to a notebook via USB to show the image in real time?
Yes - acts just like a webcam so can use any software that can display an image
Quote
Does it have a tripod thread?
No but I think there's enough room in the end of the battery to add one if you can find a threaded sleeve. it will just about stand on its own but obviously not very stable
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: G0HZU on November 04, 2013, 08:20:35 am
Hi Mike thanks for the info :)
It's a shame about the tripod thread but I could probably rig something (hideous) that would let me mount or clamp it securely if needed.

It's good that the camera can relay images like a webcam too. I'll try phoning around for stock tomorrow.

Note: one annoying feature of the Irisys camera was the regular loud 'clunk' it made every minute or so. I appreciate that this is a necessary part of the camera operation but does the E4 make a regular loud clunk noise? The clunk from the Irisys TC was loud enough to annoy people several benches away at work if the lab was otherwise quiet :)

 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 04, 2013, 08:30:41 am
Note: one annoying feature of the Irisys camera was the regular loud 'clunk' it made every minute or so. I appreciate that this is a necessary part of the camera operation but does the E4 make a regular loud clunk noise? The clunk from the Irisys TC was loud enough to annoy people several benches away at work if the lab was otherwise quiet :)
You can barely hear it when the lens and case is on - definitely not loud enough to annoy anyone
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: G0HZU on November 04, 2013, 08:41:44 am
OK thanks. The clunk from the Irisys sounds just like someone dropping a marble into a small metal box from about 1 foot above! After a few dozen clunks it can get very annoying for anyone in earshot. So that's another bonus point for the E4 :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: olsenn on November 04, 2013, 10:13:27 am
I bit the bullet and purchased an E4. Now I'm going to hate myself for spending money for something I didn't need... but it's just so cool!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: zapta on November 04, 2013, 01:51:31 pm
Mike, Just performed your procedure and the image looks much crispier and without that snow. The setting screen stills shows E4. This is the expected result, right?

Procedure was very simple. Used notepad for editor (verified crlf requirement) and windows's Send To Compressed (zipped) Folder over flashfs directory to create the zip, then opened the zip in Windows explorer and added copy/pasted camera.cmd.

Flir has a much happier customer now.

Great job! and many thanks. If you will need a kidney one day just ask.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Uup on November 04, 2013, 03:30:53 pm
Like others, I also just placed an order for an E4. I didn't really need a TIC and had no plans to buy one. However, an 'enhanced' E4 is excellent value and too good to pass on.

Thanks Mike (and to the other contributors) for making this possible and for sharing! Really appreciate it. Impressive work!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: digsys on November 04, 2013, 05:14:37 pm
I know a few people have posted where they purchased their unit and the price. Can we start a list of Supplier names and prices?
I'm sure there are many more ready to hit the go button. Thanks
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: amyk on November 04, 2013, 05:45:47 pm
Quote
Also, can I ask if the camera can be hooked up to a notebook via USB to show the image in real time?
Yes - acts just like a webcam so can use any software that can display an image
Here's another frivolous but "because I have one, why not" application: thermal video chat.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: aargee on November 04, 2013, 05:49:50 pm
I'm ordering an E4 E8 from the US to Australia and it is on its way.

If anyone wants to know the details, you can PM me, nothing really secret but dealers and/or FLir might not like it (or they may not care less  :-//) and I wouldn't like others to have this pathway shutdown.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: equinoxe on November 04, 2013, 06:41:52 pm
Hi Mike,
Are you going to upload a video on youtube with the results?
(and also [off topic]: have you been working on your high-res x-ray hack?)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: all_repair on November 04, 2013, 07:32:49 pm
Hi Mike,
Are you going to upload a video on youtube with the results?
(and also [off topic]: have you been working on your high-res x-ray hack?)

I love a video, but hate to push FLIR into a corner and force them into the fighting mode with no choice.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: equinoxe on November 04, 2013, 07:57:47 pm

I love a video, but hate to push FLIR into a corner and force them into the fighting mode with no choice.

Since the cat is out of the bag I doubt it will take long until it's well known that the device is easily hackable.
(que post on hackaday in 3, 2, 1...)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: garak on November 04, 2013, 08:30:02 pm

I love a video, but hate to push FLIR into a corner and force them into the fighting mode with no choice.

Since the cat is out of the bag I doubt it will take long until it's well known that the device is easily hackable.
(que post on hackaday in 3, 2, 1...)

I dunno, FLIR might have retaliated by the time HAD find this. They're incredibly slow at posting news that isn't about generic crap. It's really Arduino-a-day.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 04, 2013, 08:45:05 pm
Not planning a vid on hack - will be doing one on mods for close-up use & other oddments, and may accidentally include some very subtle clues.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: bookaboo on November 04, 2013, 09:37:28 pm
My guess is that Flir will quietly upgrade the firmware. Somewhere in Sweden some no-nothing CEOs are probably putting the pressure on the engineers.
Get the E4 while its hot I say.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: grumpydoc on November 04, 2013, 09:47:45 pm
It would be interesting to know what the exact effect on Flir's sales will be - although we will never know I expect that the result will be a few people who would have bought neither an E4 nor an E8 will now buy an E4 for the "cool hack" nature of Mike's discovery. Besides who can resist effectively buying a £5k+ device for £800

Will it mean any lost sales of E8's - TBH I would doubt it. If you're in the market for an E8 then the chances are you're in the market for a device which works as advertised out of the box, without hacks, and which will be supported by the manufacturer.

I can't see Flir patting Mike on the back and saying "good job" but their best strategy might just be to ignore it and enjoy the extra sales of the E4.

EDIT: I hadn't voted because there wasn't an "I wasn't going to buy one and still aren't but it's a cool hack" option, but did so (choosing the last option) so as to see how many people had gone for the "was going to buy an E8 but will now buy an E4) option - I see it's just 1 person and that's out of a group (eevblog forum members) who are self selected for willingness to hack hardware and/or firmware. That would tend to support the notion that Flir will gain more in E4 sales than they will loose in E8 sales - even at a 6:1 price ratio.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: amyk on November 04, 2013, 10:02:35 pm
I think FLIR knew this was going to happen as soon as the teardown video was posted. It was just a matter of figuring out details after that. A video on the hack wouldn't be that interesting either, but maybe you could do a whole video recorded on the E4. I'd also like to see what the raw sensor data looks like.

At any rate, FLIR probably don't sell that many of either the E4 or E8, so even the ~3 dozen more from this forum that the poll indicates may be quite significant.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 04, 2013, 10:03:28 pm
Regarding the lens size:
today I had the chance to get hold of an E6 for a minute and did checkout the lens. I couldn't really measure it but just by looking at it I am pretty sure: the lense is not larger than the one on my E4. I would bet that the different sensitivity values in the data sheet are just 'on paper' and not the real value when pimped to 320x240.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 04, 2013, 10:26:04 pm
Whatever Flir's attitude (If they even know yet) I highly doubt they'd ever say anything, publically or privately, due to political issues with shareholders etc.. You may get the odd snippet out of a chat with a dealer or someone at an exhibition ( simply looking at their non-verbal reaction when you mention it can often be enough to tell if it is generally known), but rumours like this aren't always reliable.
The timing and content of the next major firmware release (if any) will probably be the best indicator of their attitude. The 19.x release we've seen is probably too early to be a reaction (could be interesting to try thr first service mode hack on it though).

I've not really looked at features of the E8 compared to other units at a similar price, but £4700 seems a lot for a unit with no manual focus, manual temp range selection, wifi, touchscreen etc. even compared to the FLir Ex0 series. I can't see them selling many, and my guess is the long term plan is to cut the price of the higher end models as soon as any competitors reduce prices.

As regards sales volumes it might be interesting to compare serial numbers - maybe if everyone posted their serial no (with the last digit or two omitted if you're paranoid) some rough figures could be inferred from the maximum delta.

My guess is it's well into the thousands PA, maybe 10Ks - they are advertising quite a lot, and the E4, even in factory state, is probably the best unit under $1K in an increasing market.

It would be interesting to see if any of the big TIC dealers have seen any sudden shift in normal sales patterns, though the E series being pretty new and very good as-is  would make it hard to discern any causal effect.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: G0HZU on November 04, 2013, 11:43:21 pm
I managed to eventually find someone with genuine stock of the E4 (last one!) and have just ordered it by phone.
I tried all the usual suppliers and they all said the same thing. Sold out of E4 but can offer a next day deal on an E5.
They also said it would be 4 to 7 working days to get any more E4s...

I tried phoning maybe 8 retailers before I found someone with one on the shelf. My E4 should arrive tomorrow and I'm already hopping up and down impatiently waiting for it to arrive :)

I got the last one in stock from from Contral

http://www.contral.co.uk/ (http://www.contral.co.uk/)


Title: Re: Flir E4 Thermal imaging camera teardown
Post by: olsenn on November 05, 2013, 01:05:20 am
I ordered one from tequipment yesterday and they have (or had at least) several in stock
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: pmcouto on November 05, 2013, 01:58:26 am
Today I had an “official” E8 in my hands and the lens is the same as E4 – At least, there’s no visible difference.
The MSX feature is very useful, even at 320x240.

P.S.
No, I was not shopping for a new E4  >:D
I already have an E50.  ;D
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: zapta on November 05, 2013, 02:21:02 am
Flir has a new market opened for it, TIC's for people that don't really need it.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Petrlib on November 05, 2013, 02:23:12 am
Hello my friends. I am just waiting for my new E5. Will be possible to do "E8 hack" on this device too? Will be complicated to do for newbies as I am? Sorry for my not perfect english but I hope you will understand..
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nova1200 on November 05, 2013, 02:31:21 am
Also regarding the lens, FWIW, it seems both E4 and E8 list the lens model as "FOL7" in their image metadata, and least based on an early E8 image found on the web. I used exiftool to dump the info; very nice tool which can also extract the raw thermal and visible images from a FLIR jpg.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 05, 2013, 02:35:22 am
The serial of my E4 is 639047xx (last two digits are replaced by 'x'). I assume 639 is set as model number; as Mikes serial is  639037xx. So a few thousands are in the market (if they started with 0).

I've not really looked at features of the E8 compared to other units at a similar price, but £4700 seems a lot for a unit with no manual focus, manual temp range selection, wifi, touchscreen etc. even compared to the FLir Ex0 series.
I think the E4 E8 is pretty usable now, the only feature I am really  missing is the manual temperature range selection. Wifi etc. would be nice but is not really important.
Mike: as I remember correctly, you mentioned a few days ago, that temp. range selection can be done through the UART interface. Will this be possible any time in the regular shooting mode? Then a small ATTiny solution could be possible: By using an incremental encoder with pushbutton function there would be only one external item as the user interface needed. The display would then show the selected temp. range anyway.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 05, 2013, 02:37:58 am
Also regarding the lens, FWIW, it seems both E4 and E8 list the lens model as "FOL7" in their image metadata, and least based on an early E8 image found on the web. I used exiftool to dump the info; very nice tool which can also extract the raw thermal and visible images from a FLIR jpg.
FOL is just the focal length. As the focal length is 6.5mm they are rounding up to FOL7.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on November 05, 2013, 02:40:04 am
Regarding buying a TIC that you don't really 'need'...... I am fighting the urge to buy an E4. I already own several thermal cameras, four of which outperform the E series. BUT I still like the E4 with its upgrade potential. I believe it is a psychological  thing....being able to buy a relatively cheap model and upgrade it to a more expensive specification. My heart wants one but my logical side is holding me back due to the lack of manual modes and less than simple adjustment of focus.
GBP960 is still a lot of money to your average Jo, and I am no different.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 05, 2013, 02:54:56 am
The serial of my E4 is 639047xx (last two digits are replaced by 'x'). I assume 639 is set as model number; as Mikes serial is  639037xx. So a few thousands are in the market (if they started with 0).

I've not really looked at features of the E8 compared to other units at a similar price, but £4700 seems a lot for a unit with no manual focus, manual temp range selection, wifi, touchscreen etc. even compared to the FLir Ex0 series.
I think the E4 E8 is pretty usable now, the only feature I am really  missing is the manual temperature range selection. Wifi etc. would be nice but is not really important.
Mike: as I remember correctly, you mentioned a few days ago, that temp. range selection can be done through the UART interface. Will this be possible any time in the regular shooting mode? Then a small ATTiny solution could be possible: By using an incremental encoder with pushbutton function there would be only one external item as the user interface needed. The display would then show the selected temp. range anyway.
Yes - it's just a couple of console commands (span and level I think). You need to be in locked temp mode - not sure if you can lock/unlock via the console but may be possible. I think the values are arbitary numbers, but the onscreen temp scale does update.

I suppose one option would be to do a board that sits inline with the keypad cable and connects to the serial FFC connector. And work out some magic key sequences to activate your functionality.
Another option may be to mod the battery base to add buttons.
or an accelerometer that recognises a 'magic shake'
or a hall sensor so you can use an external magnet to activate.

You may be able to read data via the console to infer enough info about the UI state to be able to activate & control a mod board - you can certainly read the current span and level, so if these freeze you an infer that the range has been locked.
there might be a way to read button states as well.
While you're at it another handy extra may be a freeze button to hold the current image, again easy to do with the console.   

I wonder if you could slip in a touchscreen, or some capsense buttons between the screen and the fascia?

 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 05, 2013, 02:56:02 am
Regarding buying a TIC that you don't really 'need'...... I am fighting the urge to buy an E4. I already own several thermal cameras, four of which outperform the E series. BUT I still like the E4 with its upgrade potential. I believe it is a psychological  thing....being able to buy a relatively cheap model and upgrade it to a more expensive specification. My heart wants one but my logical side is holding me back due to the lack of manual modes and less than simple adjustment of focus.
GBP960 is still a lot of money to your average Jo, and I am no different.
well you could always sell one of the other ones.... (BTW was it you that picked up that Irisys people counter? - PM me if you want to sell it) 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on November 05, 2013, 03:00:45 am
Mike: as I remember correctly, you mentioned a few days ago, that temp. range selection can be done through the UART interface. Will this be possible any time in the regular shooting mode? Then a small ATTiny solution could be possible: By using an incremental encoder with pushbutton function there would be only one external item as the user interface needed. The display would then show the selected temp. range anyway.

That's also what I recall, the temp range being settable through UART. I was thinking of an msp430 + buttons (or capsense slider) + bluetooth module as possible battery slurping additions... Or maybe an accelerometer to give it the secret handshake. :P The usability would depend a bit on how fast the respons to a range set command is + any easy to operate locations for a button.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on November 05, 2013, 03:04:35 am
I suppose one option would be to do a board that sits inline with the keypad cable and connects to the serial FFC connector. And work out some magic key sequences to activate your functionality.

Yeah, thought about the mcu-in-the-middle as well for the keypad. But then you'll have to keep track of the UI state, which can get annoying real fast.

And touchscreen would indeed be funky, but that only gets to be meaningful (IMO) when you can integrate that properly into the GUI. Otherwise it's just too much hassle for what you get in return.

Custom GUI anyone?  ;D
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on November 05, 2013, 03:10:41 am
Hi Mike,

Sell one of my 'babies'  :scared:

I may sell a Talisman but the FLIR PM570's and 695's are ITAR liable so selling them is complicated  ;)

Yes I bought the IRISYS people counter.

The rear labelling says:

IRC 1004-3
CAN Master

I have not used it so would be willing to sell it on as I have other projects to get on with.

IRISYS told me that it can be easily accessed via the low voltage RS232 serial interface. I was also given the software to do so. Itsin very nice condition and has not been taken apart  :)

PM me what you think it is worth to you and I will provide a fast response.

I attach pictures.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: firewire on November 05, 2013, 03:20:46 am
I know a few people have posted where they purchased their unit and the price. Can we start a list of Supplier names and prices?
I'm sure there are many more ready to hit the go button. Thanks

http://www.valuetesters.com/flir-e4-thermal-imaging-camera-msx-enabled.html (http://www.valuetesters.com/flir-e4-thermal-imaging-camera-msx-enabled.html) Advertised price is $995, but $895 if you "request a quote via email".
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 05, 2013, 03:22:04 am
And touchscreen would indeed be funky, but that only gets to be meaningful (IMO) when you can integrate that properly into the GUI. Otherwise it's just too much hassle for what you get in return.
Not necessarily - if you could just add maybe a strip at the bottom or side using a thin PCB, you could create some virtual buttons at fixed positions just outside the visible area - you don't really need much - just an up/down for span and level when you detect that locked mode has been entered.
 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: cyr on November 05, 2013, 03:24:33 am
Resistance was futile, another E4 sale thanks to Mike...
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: termi on November 05, 2013, 03:28:22 am
Another one sold ... couldn't resist for <USD880 shipped   ;D

Thanks Mike and eevblog community!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 05, 2013, 03:38:48 am
I know a few people have posted where they purchased their unit and the price. Can we start a list of Supplier names and prices?
I'm sure there are many more ready to hit the go button. Thanks

http://www.valuetesters.com/flir-e4-thermal-imaging-camera-msx-enabled.html (http://www.valuetesters.com/flir-e4-thermal-imaging-camera-msx-enabled.html) Advertised price is $995, but $895 if you "request a quote via email".

From their website :
Quote
Value Testers sells worldwide.  Our sales people have a great deal of experience with international markets, as we have sold to almost 150 countries worldwide.  We provide excellent customer service that is based on building relationships with our customers who become our friends.  Value Testers helps customers to select products that exactly match their needs and at the same time are the least expensive solution.  We also help customers to find the best and resonably priced shipping.  We work as a team to help our customers.
Quote
Amprobe and Fluke products can be shipped only within US, as per agreement between manufacturers and US distributors.  The same relates to Thermal Imagers frequency 33kHz or higher.
33kHz?

Has anyone tried ordering from outside US?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 05, 2013, 03:53:24 am
Yeah, thought about the mcu-in-the-middle as well for the keypad. But then you'll have to keep track of the UI state, which can get annoying real fast.
Not neccessarily: At least with the current firmware, most buttons do not have any functionality when you are in regular shooting mode. So you might either check for combinations like
Back-button (upper right button) pressed together with up / down and left/right
or just using these buttons as they do not have any function anyway:

Some ideas:
Enable manual temperature mode: pressing 'back-button' for >1 second
up/down: setting upper temperature (each short click +/- 0.5°C for example; each longer click +/- 5°C)
left/right: setting lower temperature
disable edit mode:  pressing middle button

Also a remember function might be useful: entering the edit mode and then pressing the middle push button first, will set the values used last time and exits edit mode.

Well, the above will work if you are not in locked mode, but it will also do no harm.

Any other ideas which could be useful and which can be set by the UART interface?


As my camera is still closed (only removed the front yet to get access to the UART connector): does anybody know how many wires the FPC for the keyboard has? I assume 0.5mm spacing? The current functionality indicates that the E4 is not using a matrix but single lines for each button = then 9 wires would be needed as minimum.

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on November 05, 2013, 03:59:54 am
Not necessarily - if you could just add maybe a strip at the bottom or side using a thin PCB, you could create some virtual buttons at fixed positions just outside the visible area - you don't really need much - just an up/down for span and level when you detect that locked mode has been entered.

True, but for me that would be too much hassle for what you get in return. As in, if the only functionality I get is some fixed function virtual buttons, I think I would just go with some actual buttons. As for an actual touchscreen fully covering the LCD, do you think the case would accommodate that? I would expect so, but I haven't had an E4 in my hands yet.  :D
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 05, 2013, 04:04:37 am
Yeah, thought about the mcu-in-the-middle as well for the keypad. But then you'll have to keep track of the UI state, which can get annoying real fast.
Not neccessarily: At least with the current firmware, most buttons do not have any functionality when you are in regular shooting mode.
Not strictly true once hacked - blue-below and red-above palette options use up/down.
and you need to reliably determine when you are in regular shooting mode.
Quote

 
Any other ideas which could be useful and which can be set by the UART interface?
Look through the PDF linked a while ago that documents a lot of the comamnd line stuff.

Quote
As my camera is still closed (only removed the front yet to get access to the UART connector): does anybody know how many wires the FPC for the keyboard has? I assume 0.5mm spacing? The current functionality indicates that the E4 is not using a matrix but single lines for each button = then 9 wires would be needed as minimum.
Not offhand but have a look in the teardown vid in case you can see it.
I think it may be 1mm pitch - will check.
If you can get something behind the display window for some touch buttons I think that would be the neatest option. You could maybe even do sliders..!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on November 05, 2013, 04:10:58 am
The FFC for the keyboard looks to have 8 connections.

Edit: and looks to be 1mm pitch yeah.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ixfd64 on November 05, 2013, 04:23:36 am
Does the original hack also enable picture-in-picture, or does that require additional steps?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 05, 2013, 04:32:50 am
Quote
The FFC for the keyboard looks to have 8 connections.
mmmh- 4x4 matrix then. The same PCB might be used for other Flir cameras where they are using more buttons.

Quote
Not strictly true once hacked - blue-below and red-above palette options use up/down.
Thats correct; I forgot that.
Quote
and you need to reliably determine when you are in regular shooting mode.
Not really, because if I recognize the pressed keys in parallel (= µC is not inbetween); the worst thing which could happpen, would be an accidentely sent manual temperature set which only would be accepted when in lock mode. However I shall add a time function that the edit mode will exit anyway after 5 seconds without any pressed key.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 05, 2013, 04:40:24 am
Does the original hack also enable picture-in-picture, or does that require additional steps?
The only hack that doesn't do PIP is the very first one of simply running in service mode with no tweaked files. 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Petrlib on November 05, 2013, 05:20:35 am
Hello friends,
nobody asnwered my question. Dear Mike, will your "hack" unlocked some functions from E8 on my E5?
Thank you for your answer.

Petr
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nova1200 on November 05, 2013, 05:28:17 am
FOL is just the focal length. As the focal length is 6.5mm they are rounding up to FOL7.
Ah, thanks, thought it was somewhat odd looking for a model number.

For the survey, my E4's serial number is 639027xx.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: olsenn on November 05, 2013, 05:29:35 am
Quote
Hello friends,
nobody asnwered my question. Dear Mike, will your "hack" unlocked some functions from E8 on my E5?
Thank you for your answer.


Yes, this hack will upgrade your E5 to an E8
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: PA0PBZ on November 05, 2013, 05:30:48 am
Hello friends,
nobody asnwered my question. Dear Mike, will your "hack" unlocked some functions from E8 on my E5?
Thank you for your answer.

Petr

I don't see why not, it should enable the same functions as in the E4.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Petrlib on November 05, 2013, 05:43:16 am
Hello friends,
nobody asnwered my question. Dear Mike, will your "hack" unlocked some functions from E8 on my E5?
Thank you for your answer.

Petr

I don't see why not, it should enable the same functions as in the E4.

Great news.. Thank you so much..
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 05, 2013, 05:58:15 am
Another possible feature for a MCU add-on - timelapse mode.
You could maybe also do auto shoot on detection for wildlife/security by looking for a rise in the temp scale (you can read this via level and span commands).

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: olsenn on November 05, 2013, 06:07:14 am
Does the E4/E8 need to be up close to the item you're viewing, or could I look out my apartment window with the thing and see the heat signitures of people walking 4 streets down?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: AndyC_772 on November 05, 2013, 06:08:22 am
Another possible feature for a MCU add-on - timelapse mode.
You could maybe also do auto shoot on detection for wildlife/security by looking for a rise in the temp scale (you can read this via level and span commands).
For that application, a trigger output to activate a conventional camera with flash would be handy.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 05, 2013, 08:07:51 am
Oops -seems like that keypad flex isn't up to lots of repeated openings and closing... 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on November 05, 2013, 08:13:55 am
I have a similarly damaged flex I one of my TIC's.

Any thoughts on how you will repair this, or is the flex replaceable ?

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: M. András on November 05, 2013, 08:14:04 am
repair video is coming as i see :P
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ixfd64 on November 05, 2013, 08:26:42 am
Does the E4/E8 need to be up close to the item you're viewing, or could I look out my apartment window with the thing and see the heat signitures of people walking 4 streets down?

I'm also curious about the effective range of thermal cameras. While I wouldn't expect one to be able to pick up the surface temperature of the Moon, there must be some distance up to which we can get an accurate measurement.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on November 05, 2013, 08:32:43 am
Range depends very much upon the lens fitted. A 45 Degree lens has a shorter range than say a 5 degree telephoto lens. It is little different to an optical lens capability in this respect. Obviously sensitivity of eth micro-bolometer is also part of the equation. The E series have decent sensitivity across the model range.

I will dig out my specs on lens versus maximum distance for you. The target is usually a human for such specs as the usage is often security.

In case anyone is unaware....a TIC will NOT see through glass so you would have to open a window to see outside.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 05, 2013, 08:40:33 am
Fortunately there's plenty of spare length, and it's 1mm pitch.


Would have replaced it but the key PCB is sandwiched under the plastic fascia that looks like it's glued in.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: olsenn on November 05, 2013, 08:50:10 am
Mike saves the day
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Monkeh on November 05, 2013, 08:51:06 am
Oops -seems like that keypad flex isn't up to lots of repeated openings and closing...

When are they ever?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on November 05, 2013, 08:51:58 am
FLIR have a decent document on maximum range of a TIC. I attach it for your information.

I have looked at the sky with my PM695 and on the -40 to +120 Degrees Celcius range, clear sky reads -34 Degrees Celcius. It is colder than -34 at high altitudes on the edge of space....around -50 Degrees IIRC. So the camera does not accurately read true 'space' temperatures but maybe 'sees' atmospheric temperatures up to its maximum range.
The moon may be seen as it is reflecting the suns rays towards Earth. I cannot recall what temperature it read but I very much doubt such would be anywhere near accurate. My 695 has a 24 Degree lens and X4 zoom, so the equivalent lens would be 6 Degrees at full zoom, but the moon still looked awful small in the viewfinder ! With a wide angle lens such as fitted on the E series, observation of the moon would be challenging.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: dr.diesel on November 05, 2013, 08:55:49 am
Mike saves the day

Just made Hack-a-day again as well!

http://hackaday.com/2013/11/04/manufacturer-crippled-flir-e4-thermal-camera-hacked-to-perform-as-high-end-model/ (http://hackaday.com/2013/11/04/manufacturer-crippled-flir-e4-thermal-camera-hacked-to-perform-as-high-end-model/)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Wann on November 05, 2013, 10:59:54 am
Mike saves the day

Just made Hack-a-day again as well!

http://hackaday.com/2013/11/04/manufacturer-crippled-flir-e4-thermal-camera-hacked-to-perform-as-high-end-model/ (http://hackaday.com/2013/11/04/manufacturer-crippled-flir-e4-thermal-camera-hacked-to-perform-as-high-end-model/)

Almost 400 guests. Wow...

So FLIR Sweden is like  :rant: tomorrow?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Hypernova on November 05, 2013, 12:29:37 pm
Hack a Day is off their game, that it took this long was a damn Christmas miracle.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Mavro on November 05, 2013, 02:21:23 pm
I've gotten into Service Mode on the i7, but the display is largely the same; there aren't enough pixels on the LCD to show 320x240! Although doug this on an i3 would probably show i7 resolution in Service Mode. The main obstacle to converting the i7 to i3 and back is the EEPROM password. Any ideas?

I'm in the same spot -- EEPROM is locked.  Do we have the password?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Mavro on November 05, 2013, 02:26:03 pm
Now heres a question for you all......
There are a lot of FLIR i3's out there........Hmmmmm I wonder if they can be upgraded in a similar manner ? i3's should be being discounted soon, and cheaper on the used marketplace due to the E4's arrival. We know the i7 can be hacked.
AFAIUI the i3 can be made into an i7, which was the subject of the lost email, but even the i7 is only 120x120

Is this posted somewhere?   I am in service mode -- but it seems like the EEProm is locked to change the camera name from FLIR_i3 to FLIR_i7?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 05, 2013, 02:28:40 pm
@hackaday:
It's not a wonder - no dedicated topic blogging about it but all info hidden deep in some comments to a teardown...

... btw - I can confirm that the E4 is priced at ~$896 (free UPS ground shipping within continental US) when requesting a quote from http://valuetesters.com (http://valuetesters.com) - unfortunately it seems there's not a human processing that request - the comments get ignored (intl. shipping).

According to my estimations that would equal to somewhere around 980€ EDIT2: 1008€ shipped & taxed to Germany - with roughly $180 for UPS expedited and paid via Paypal (5% exchance losses there)...
... still approx. 160€EDIT2: 130€ below the cheapest european source I could find. (EDIT: JFYI - I have my order running already - went for an EU source)

EDIT2: depends on which customs tariff code would be applied... this one is the safer guess

Currently I'm owning a chinese FLIR knockoff (older model) with 160x120 res. and some issues - so will join the E4 owners soon ;)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: BravoV on November 05, 2013, 02:39:51 pm
Mike, since you're the thread starter, I think its time to update the 1st post with summary and few notes, like the one you've done at post #524 -> HACK SUMMARY (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg321956/#msg321956), especially with the influx of new users here after the Hack a day announcement, otherwise this thread will be flooded with basic requests and questions about the hack.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: aargee on November 05, 2013, 02:51:54 pm
Actually I though Mike's post #524 was the latest and greatest? But yes, pinning it to the front of the thread is a good idea.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: BravoV on November 05, 2013, 02:54:39 pm
You're right, post updated with link to post #524.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Rasz on November 05, 2013, 04:17:11 pm
In case anyone is unaware....a TIC will NOT see through glass so you would have to open a window to see outside.

unless you are muOptics!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ViciousPest on November 05, 2013, 07:14:04 pm
Long time listener first time caller. Just ordered my E4. So if I read all 45 pages of the thread its no longer considered an impulse buy, correct?   :-// Regardless. I assume many of us will be receiving our E4 shortly. Has anyone confirmed that they are shipping with a newer fw? I saw a post about 1.19.x being on the device. I doubt they would be able to patch it that quickly.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 05, 2013, 07:15:38 pm
Re. the i3/7, if it is the same as the E4, then the EEPROM is not where you need to be looking.
On the E4, the  configuration comes from the conf.cfg file, which is protected by a CRC01 and having the serial number in the file to prevent copying between units.

There are at least a couple of people here with i3/i7 - maybe they could investigate further - I suspect the E4 hack method, or something very similar may well work on the i series
 

 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 05, 2013, 07:26:13 pm
Tequipment's stock of E4's (http://www.tequipment.net/FLIRE4.html) has gone from 12 yesterday afternoon to 5 now...
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: amyk on November 05, 2013, 07:49:45 pm
Is there something special about this cable (http://www.tequipment.net/Flir1195128.html)?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Zoltan von Negrow on November 05, 2013, 07:54:10 pm
Is there something special about this cable (http://www.tequipment.net/Flir1195128.html)?

No, it´s normal USB-A - Micro-B USB cable
You can use standard micro USB charger for charging E4
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 05, 2013, 07:55:13 pm
Is there something special about this cable (http://www.tequipment.net/Flir1195128.html)?
Only that it plugs into a $xxxx device - I wonder if anyone has ever bought one..?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 05, 2013, 08:01:26 pm

Mike - you wrote once something about 336x252 (or similar) physical sensor resolution...
Did you try out what happens when setting the resolution to the sensor's phys max or even above (or E6 res for example)?
Like whether the full res. then gets saved to files/snapshots or is beeing presented over USB.

Currently I'd assume that the cam always outputs 320x240 on all channels as I didn't see saved images with just 80x60 pixel resolution yet.


Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Richard Wad on November 05, 2013, 08:07:04 pm
Is there something special about this cable (http://www.tequipment.net/Flir1195128.html)?

lol, wow... 75$ for a 1$ cable.
my cell phone usb cable works just the same as the one included with the e4
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 05, 2013, 08:14:18 pm

Mike - you wrote once something about 336x252 (or similar) physical sensor resolution...
Did you try out what happens when setting the resolution to the sensor's phys max or even above (or E6 res for example)?
Like whether the full res. then gets saved to files/snapshots or is beeing presented over USB.

Currently I'd assume that the cam always outputs 320x240 on all channels as I didn't see saved images with just 80x60 pixel resolution yet.
Not me - I don't recall seeing that resolution referenced anywhere. Sometimes visible image sensors have additional rows/columns for calibration purposes -e.g. masked to get a dark reference No idea if TIC sensors do similar things
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 05, 2013, 08:36:48 pm
Not me - I don't recall seeing that resolution referenced anywhere. Sometimes visible image sensors have additional rows/columns for calibration purposes -e.g. masked to get a dark reference No idea if TIC sensors do similar things
Ah, sorry |O  didn't see the italics (print view) and overlooked the initial line in post #261 ... plus now I remembered that you did connect a probe to the sensor and that you said something about 320x240 x 60Hz as output. ...

...and before I forget: THX to all you guys who cooperated on this thread  :-+
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: amyk on November 05, 2013, 09:38:30 pm
Is there something special about this cable (http://www.tequipment.net/Flir1195128.html)?
Only that it plugs into a $xxxx device - I wonder if anyone has ever bought one..?
I could imagine a management-level purchaser being convinced into buying one for each of the cameras in a large order, "because the video has less noise using our cables" :-DD

Also curious if there's something in the warranty statement about it being void when the unit is used with "third-party accessories"...
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 05, 2013, 09:47:21 pm
OT / @Cable: this reminds me of a 140 DM (yes, long long ago - nowadays it would be 140€) iLink(aka Firewire) cable (1,5m) ... specialty: was branded Sony and had a nice purple plastic instead of generic black ... of cause it was next to the camcorders ... approx 20m distance to the normally overpriced cables :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 05, 2013, 10:43:23 pm
Another possible feature for a MCU add-on - timelapse mode.
You could maybe also do auto shoot on detection for wildlife/security by looking for a rise in the temp scale (you can read this via level and span commands).
Good idea. I could not find the possible/allowed UART commands / parameter in this thread but I may have overseen them (due to the size of 46 pages I did just a quick scan). Can you please point me to the correct place or restate them? Thanks

Oh, and I am sorry for your cable! On long term it might be better to repair with another short FPC cable (add solder on one cable, then place contacts to contacts of old/new cable and heat from the top, that works pretty well).
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: AndyC_772 on November 05, 2013, 10:51:03 pm
The Audiophool industry has got there already with USB cables. Try a search for "oxygen free silver usb cable" and prepare to cry...  :palm:
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: olsenn on November 05, 2013, 11:46:22 pm
Quote
The Audiophool industry has got there already with USB cables. Try a search for "oxygen free silver usb cable" and prepare to cry... 

The cryro-treated, oxygen-free, OCC silver USB cable with gold injections really brings out a subtle sibilance and a rich, lushous, tonally neutral, punchy, forward soundstage.

I almost forgot, it also reduces aberrations due to the skin effect!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 05, 2013, 11:47:11 pm
Another possible feature for a MCU add-on - timelapse mode.
You could maybe also do auto shoot on detection for wildlife/security by looking for a rise in the temp scale (you can read this via level and span commands).
Good idea. I could not find the possible/allowed UART commands / parameter in this thread but I may have overseen them (due to the size of 46 pages I did just a quick scan). Can you please point me to the correct place or restate them? Thanks

Oh, and I am sorry for your cable! On long term it might be better to repair with another short FPC cable (add solder on one cable, then place contacts to contacts of old/new cable and heat from the top, that works pretty well).
It's the T59504PDF linked here
http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg316284/?topicseen#msg316284 (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg316284/?topicseen#msg316284)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: equinoxe on November 05, 2013, 11:51:17 pm
The Audiophool industry has got there already with USB cables. Try a search for "oxygen free silver usb cable" and prepare to cry...  :palm:

I cried when a audiophool "explained" that his "special" hDmi (where the D stands for DIGITAL!) cables enhanced the sound and image of his (encrypted!!) signal..

A phool born every minute..
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: olsenn on November 06, 2013, 12:19:16 am
I just noticed that e4hack3.zip has been downloaded 129 times already. Undoubtably not all of those were from owners of an Ex camera, but it's nice to see that people are grabbing copies of the file before the thread gets deleted... you know, just in case :)

Predator vision is in transit!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: 0xdeadbeef on November 06, 2013, 12:38:27 am
Talking of predator vision, even though a bit offtopic:
http://www.trotec24.com/en-de/measuring-instruments/temperature/infrared-cameras/ec060-v-infrared-camera.html (http://www.trotec24.com/en-de/measuring-instruments/temperature/infrared-cameras/ec060-v-infrared-camera.html)
Claims to have 50/60Hz frame rate. Features video output, 160x120 sensor resolution, PIP and manual focus.
The onscreen display looks a bit unprofessional though, also some people on Amazon complain about build quality (battery charger etc.).
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: _Sin on November 06, 2013, 12:45:04 am
FWIW, if anyone is tracking, I just got an E4 with a serial# north of 5k, and firmware v1.19.8.

I'll definitely want to be able to focus it a bit closer, so looking forward to seeing any of Mike's experiments in making a tool to adjust that easily.

Have already spotted a possible irregularity with the office air-conditioning... it's not a toy, honest!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: olsenn on November 06, 2013, 12:46:08 am
Mike, can the E4 be hacked to provide 30/60 Hz refresh rate? I imagine the 9Hz operation is not limited by hardware but rather by export law.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 06, 2013, 12:56:19 am
FWIW, if anyone is tracking, I just got an E4 with a serial# north of 5k, and firmware v1.19.8.

I'll definitely want to be able to focus it a bit closer, so looking forward to seeing any of Mike's experiments in making a tool to adjust that easily.

Have already spotted a possible irregularity with the office air-conditioning... it's not a toy, honest!
One thing to check - the main obvious bug in the older FW is it doesn't show time/date in the file information - is this fixed in 1.19?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 06, 2013, 12:57:00 am
Another possible feature for a MCU add-on - timelapse mode.
You could maybe also do auto shoot on detection for wildlife/security by looking for a rise in the temp scale (you can read this via level and span commands).
Good idea. I could not find the possible/allowed UART commands / parameter in this thread but I may have overseen them (due to the size of 46 pages I did just a quick scan). Can you please point me to the correct place or restate them? Thanks

Oh, and I am sorry for your cable! On long term it might be better to repair with another short FPC cable (add solder on one cable, then place contacts to contacts of old/new cable and heat from the top, that works pretty well).
It's the T59504PDF linked here
http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg316284/?topicseen#msg316284 (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg316284/?topicseen#msg316284)

Thanks Mike.
I assume it is chapter 4.2.4.5 on page 59.
But how do I send the command?

Like this below if I want a span from 0°C to 100°C (=273 / 373 Kelvin)?

38400 Baud; ASCII through RS232 interface:
"rset .image.contadj.adjMode manual CR/LF"
"rset .image.sysimg.basicImgData.extraInfo.lowT 273 CR/LF"
"rset .image.sysimg.basicImgData.extraInfo.highT 373 CR/LF"


Thats all?
Is CR and LF correct or only CR?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 06, 2013, 01:00:05 am
By the way:
When looking at the JPG EXIF information of a picture, there is noted 'E4' as camera model and some more information like lens, distance etc.
You might rename E4 to E8 in an EXIF editor and you might think you did it, but ... in Flir Tools it is still showing "E4" and also the serial number of the camera is shown there. So there are some more information hidden somewhere.
Does anybody have an idea how to get rid of these informations (by not loosing the other informations Flir Tools are using e.g. digital camera picture, temperature span etc.)?


Title: Re: Flir E4 Thermal imaging camera teardown
Post by: BravoV on November 06, 2013, 01:05:51 am
By the way:
When looking at the JPG EXIF information of a picture, there is noted 'E4' as camera model and some more information like lens, distance etc.
You might rename E4 to E8 in an EXIF editor and yiu might think it is OK, but ... in Flir Tools it is still showing "E4" and also the serial number of the camera is shown there.
Does anybody have an idea how to get rid of these informations (by not loosing the other informations Flir Tools are using e.g. digital camera picture, temperature span etc.)?
Assuming you use Window, freeware, get this -> http://freeweb.siol.net/hrastni3/foto/exif/exiftoolgui.htm (http://freeweb.siol.net/hrastni3/foto/exif/exiftoolgui.htm)

Use the Remove Metadata sub menu to clear any stickied attributes from a photo.

(http://freeweb.siol.net/hrastni3/foto/exif/etgui4.png)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: _Sin on November 06, 2013, 01:18:51 am
One thing to check - the main obvious bug in the older FW is it doesn't show time/date in the file information - is this fixed in 1.19?

No, it's not showing that on the device (you're right, this makes no sense from a UI perspective). It bakes it correctly into the file though, so it's OK when viewed elsewhere (though I have yet to work-out/RTFM how to view both the normal and thermal images when browsing files - it shows both on the camera, but the JPEG image appears only to contain the thermal image)

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: equinoxe on November 06, 2013, 01:23:54 am
BTW. Is there a way to remove the "flir" branding from the image?
It's nice when you are senile and need to be remembered which brand camera you have, but otherwise it's useless, takes up measurable space and quite frankly I think it's rather annoying..
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 06, 2013, 01:40:58 am
Another possible feature for a MCU add-on - timelapse mode.
You could maybe also do auto shoot on detection for wildlife/security by looking for a rise in the temp scale (you can read this via level and span commands).
Good idea. I could not find the possible/allowed UART commands / parameter in this thread but I may have overseen them (due to the size of 46 pages I did just a quick scan). Can you please point me to the correct place or restate them? Thanks

Oh, and I am sorry for your cable! On long term it might be better to repair with another short FPC cable (add solder on one cable, then place contacts to contacts of old/new cable and heat from the top, that works pretty well).
It's the T59504PDF linked here
http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg316284/?topicseen#msg316284 (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg316284/?topicseen#msg316284)

Thanks Mike.
I assume it is chapter 4.2.4.5 on page 59.
But how do I send the command?

Like this below if I want a span from 0°C to 100°C (=273 / 373 Kelvin)?

38400 Baud; ASCII through RS232 interface:
"rset .image.contadj.adjMode manual CR/LF"
"rset .image.sysimg.basicImgData.extraInfo.lowT 273 CR/LF"
"rset .image.sysimg.basicImgData.extraInfo.highT 373 CR/LF"


Thats all?
Is CR and LF correct or only CR?
I don't know if you can do it with rset  -there are "level" and "span" commands which definitely work
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 06, 2013, 01:50:09 am
Assuming you use Window, freeware, get this -> http://freeweb.siol.net/hrastni3/foto/exif/exiftoolgui.htm (http://freeweb.siol.net/hrastni3/foto/exif/exiftoolgui.htm)
Use the Remove Metadata sub menu to clear any stickied attributes from a photo.
Thanks. I knew this program before, but not the GUI. That makes it a lot more comfortable!
But .... not working :-(
Of course it then removes everything ... but also all embedded information you might need in Flir tools.

I could see beside the sections JFIF, EXIF etc. there is a section called APP1 (see below)
Now the question is: how can I edit APP1 without deleting everything? It seems I do not have the chance to edit any single entry of this APP1 section with this tool.

---- APP1 ----
Emissivity                      : 0.95
ObjectDistance                  : 1.00 m
ReflectedApparentTemperature    : 20.0 C
AtmosphericTemperature          : 20.0 C
IRWindowTemperature             : 20.0 C
IRWindowTransmission            : 1.00
RelativeHumidity                : 50.0 %
PlanckR1                        : 14469.053
PlanckB                         : 1392.2
PlanckF                         : 2.5
CameraTemperatureRangeMax       : 250.0 C
CameraTemperatureRangeMin       : -20.0 C
CameraModel                     : FLIR E4
CameraPartNumber                : 63901-0101
CameraSerialNumber              : 639047xx
CameraSoftware                  : 22.0.0
LensModel                       : FOL7
LensPartNumber                  :
LensSerialNumber                :
FieldOfView                     : 45.0 deg
FilterModel                     :
FilterPartNumber                :
FilterSerialNumber              :
PlanckO                         : -7489
PlanckR2                        : 0.026838331
RawValueMedian                  : 12412
RawValueRange                   : 632
DateTimeOriginal                : 2013:10:26 13:06:58.710+00:00
FocusStepCount                  : 70
FocusDistance                   : 0.0 m
PaletteColors                   : 224
AboveColor                      : 170 128 128
BelowColor                      : 50 128 128
OverflowColor                   : 67 216 98
UnderflowColor                  : 41 110 240
Isotherm1Color                  : 100 128 128
Isotherm2Color                  : 100 110 240
PaletteMethod                   : 0
PaletteStretch                  : 2
PaletteFileName                 : \FlashBFS\system\iron.pal
PaletteName                     : Iron
Palette                         : (Binary data 672 bytes, use -b option to extract)
RawThermalImageWidth            : 80
RawThermalImageHeight           : 60
RawThermalImageType             : PNG
RawThermalImage                 : (Binary data 5779 bytes, use -b option to extract)
Real2IR                         : 1.33978033065796
OffsetX                         : -12
OffsetY                         : +0
PiPX1                           : 0
PiPX2                           : 80
PiPY1                           : 0
PiPY2                           : 60
EmbeddedImageWidth              : 640
EmbeddedImageHeight             : 480
EmbeddedImageType               : DAT
EmbeddedImage                   : (Binary data 25074 bytes, use -b option to extract)


P.S. If anybody wonders: the above has been copied on a picture of an unhacked E4 (thats why 80x60) but will be the same with a hacked one (beside the resolution, which will be shown correctly as 320x240 then).

EDIT: the string E4 and the serial number can be found and edited with a HEX editor. So there is just a tool needed which can show and edit App1 section.

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 06, 2013, 01:51:27 am
BTW. Is there a way to remove the "flir" branding from the image?
It's nice when you are senile and need to be remembered which brand camera you have, but otherwise it's useless, takes up measurable space and quite frankly I think it's rather annoying..
If you remove all Metadata as explained above, the Flir logo is gone. But keep a copy as every other information of the file is gone then too.

EDIT: mmmh - I tried it again, now the logo stays. Probably I wrote crap. Just ignore the above.
Another solution: Open your file in Flir tools. Logo etc. are gone and you can adapt the picture as you like. Now make a screen copy of the picture-screen area and save as JPG. But your usual large temperature reference is also gone now - you may copy it with the narrower one of Flir tools. No other way as Flir does not allow a "save" of the plain picture here.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: CesarEscudero on November 06, 2013, 01:52:22 am
Is there anyway FLIR can patch this hack? I want to buy one but, unfortunately,  not this year...  :'(
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tnt on November 06, 2013, 02:10:18 am
Is there anyway FLIR can patch this hack? I want to buy one but, unfortunately,  not this year...  :'(

As mentionned earlier ... yes, plenty of ways. Especially for new camera. But even if you updated the fw on a old one there is plenty of things they could do.

Would it be un-hackable ? Doubtful, but they could make it really painful and then you'd need motivated people that don't already have an hacked one to get to work on it ... Actually now that I think on it, doing it only for new cam might be a good technique ... I'm sure several people (me for eg) wouldn't spend any time looking at bypassing a new protection scheme if the old bypass kept working on my camera ...
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: m4rkiz on November 06, 2013, 02:11:51 am
some basic i3 info from different posts in this thread collected together for newbies like me ;)

simple solution that changes i3 temporarily to i7 but doesn’t void warranty as there no modifications to camera at all
- turn on camera
- press left menu button once
- press gallery (play) button for 5 seconds

you should have ‘diagnostic’ screen open

- under left menu, change usb mode to RNDIS
- install flir drivers http://cdn.cloud.flir.se/swdownload/assets/other/flir_device_drivers.exe (http://cdn.cloud.flir.se/swdownload/assets/other/flir_device_drivers.exe)
- connect camera to your pc

(at this point it should install as network card with dhcp active and camera should be accessible through www [port 80, there is also few more things active – check 3rd page of http://www.imc-store.com.au/v/vspfiles/assets/images/flir%20a310%20technical%20notes.pdf (http://www.imc-store.com.au/v/vspfiles/assets/images/flir%20a310%20technical%20notes.pdf) ] rtsp stream is obviously not available)

- open your browser and navigate to http://192.168.0.2 (http://192.168.0.2) then activate service mode – user:flir password:3vlig
- give it 30-40 seconds without pressing any keys, it will reboot and it will have i7 angles and resolution on the screen

those changes are reversed with every reboot so reset it with a switch or let it turn off when you are done with it

sample pictures from my i3 (http://img30.imageshack.us/img30/3989/30ht.jpg)

all informations quoted here were provided in this thread by various users, thanks lads

BTW, is there any way to reboot it without using hardware switch in battery compartment or waiting until it powers down by itself - long press on power button don't work for me at all
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 06, 2013, 02:24:42 am
Get' em while you can -Tequipment stock went from 12 yesterday down to the last one in stock today!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: scibit on November 06, 2013, 02:38:28 am
Ordered mine earlier today  :-+
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: all_repair on November 06, 2013, 02:44:01 am
Just sent in an order.  Remember to ask for the discount code.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: scibit on November 06, 2013, 02:53:00 am
Forgot to at the time, but I just contacted them and they changed it down to $895
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ViciousPest on November 06, 2013, 02:56:01 am
Forgot to at the time, but I just contacted them and they changed it down to $895

Ordered mine last night. Do you think its too late for me to get discount? What did you say when you called? Thanks for any help you can provide
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ViciousPest on November 06, 2013, 03:05:48 am
What are some "to-dos" for the hack? Getting the E8 feature set has been done much thanks to Mike. What are other things people have requested? I have experience with REing embedded systems (although none with Windows CE) and am looking forward to modifying mine. One of the main reasons I decided to buy one IS because there is still functionality to add. Here is list of things that I gathered from the posts/video:

Again any insight or additions you can provide would be appreciated.
Some questions:
Is the refresh rate hardware restricted or software?
Regarding temperature adjustment, this is achieved via serial commands correct?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: scibit on November 06, 2013, 03:16:48 am
Forgot to at the time, but I just contacted them and they changed it down to $895

Ordered mine last night. Do you think its too late for me to get discount? What did you say when you called? Thanks for any help you can provide

I don't think my order had been processed yet. I just used the live chat on the website and said that I'd been quoted it cheaper on another site, then asked if it was too late to take advantage of their price match guarantee.
They just wanted to know where I got the quote from and were happy update my order to match it.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: CesarEscudero on November 06, 2013, 03:56:19 am
Is there anyway FLIR can patch this hack? I want to buy one but, unfortunately,  not this year...  :'(

As mentionned earlier ... yes, plenty of ways. Especially for new camera. But even if you updated the fw on a old one there is plenty of things they could do.

Would it be un-hackable ? Doubtful, but they could make it really painful and then you'd need motivated people that don't already have an hacked one to get to work on it ... Actually now that I think on it, doing it only for new cam might be a good technique ... I'm sure several people (me for eg) wouldn't spend any time looking at bypassing a new protection scheme if the old bypass kept working on my camera ...

Too bad, I can't afford it right now.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: olsenn on November 06, 2013, 04:05:52 am
My tequipment order is still listed as being "on hold". When I ordered there were 12 in stock; now there's only 1. I will be severely pissed if they didn't reserve one for me. Hulk Smash!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ixfd64 on November 06, 2013, 04:10:52 am
OT / @Cable: this reminds me of a 140 DM (yes, long long ago - nowadays it would be 140€) iLink(aka Firewire) cable (1,5m) ... specialty: was branded Sony and had a nice purple plastic instead of generic black ... of cause it was next to the camcorders ... approx 20m distance to the normally overpriced cables :)

Kind of reminds me of the $1,000 Ethernet cable: http://www.amazon.com/Denon-AKDL1-Dedicated-Cable-Version/dp/B000I1X6PM (http://www.amazon.com/Denon-AKDL1-Dedicated-Cable-Version/dp/B000I1X6PM)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 06, 2013, 04:27:08 am
What are some "to-dos" for the hack? Getting the E8 feature set has been done much thanks to Mike. What are other things people have requested? I have experience with REing embedded systems (although none with Windows CE) and am looking forward to modifying mine. One of the main reasons I decided to buy one IS because there is still functionality to add. Here is list of things that I gathered from the posts/video:

  • Hot Swap Button (from thermal to live view)
  • Temperature Adjustment
  • Refresh rate unlock?
Again any insight or additions you can provide would be appreciated.
Some questions:
Is the refresh rate hardware restricted or software?
Regarding temperature adjustment, this is achieved via serial commands correct?
Not known if framerate is changeable but no reason for it to not be baked into the FPGA, especially due to the ITAR issues.
The only thing I've seen relating to framerate is the  "Allow_30Hz" or similar message in the bootup text, but this may just be a status readout from the FPGA.

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ron on November 06, 2013, 04:39:31 am
Get' em while you can -Tequipment stock went from 12 yesterday down to the last one in stock today!

If they really had only one left, then they have none now because I ordered one 2 minutes ago.
Cheers Mike! :-+
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 06, 2013, 05:15:42 am
FYI: If you are not from the US, don't bother Tequipment or Optimum Energy Products (shopflir.com) with a request for quote. They both do not ship the Flir E4 to non-US countries. But it can take a day or two until they answer your mails and during this waiting-time other available E4 might be gone.
Their answers for several requests were:

Flir don't want us selling into other dealers regions.
and
... Unfortunately, we are not allowed to supply FLIR products into your territory.
and
...as we do no send thermal cameras outside of the US as per federal law


In Europe there are enough available .... but +30% more expensive :-[
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ixfd64 on November 06, 2013, 05:23:48 am
You could still have it shipped to a trusted U.S. resident and have them forward it to you.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 06, 2013, 05:32:52 am
FYI: If you are not from the US, don't bother Tequipment or Optimum Energy Products (shopflir.com) with a request for quote. They both do not ship the Flir E4 to non-US countries. But it can take a day or two until they answer your mails and during this waiting-time other available E4 might be gone.
Their answers for several requests were:

Flir don't want us selling into other dealers regions.
and
... Unfortunately, we are not allowed to supply FLIR products into your territory.
and
...as we do no send thermal cameras outside of the US as per federal law


In Europe there are enough available .... but +30% more expensive :-[
valuetesters claim to ship internationally, and a couple of pages ago here someone mentioned a $100 discount for the asking
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: m4rkiz on November 06, 2013, 05:45:31 am
You could still have it shipped to a trusted U.S. resident and have them forward it to you.

there is plenty companies that do parcel forwarding i.e. http://www.viaddress.com/ (http://www.viaddress.com/) but there is a good chance that a brand new thermal cam with all accessories in unopened box together with receipts will attract enough attention of customs and one will be charged vat which makes whole operation a bit pointless

it still is worth a shot if price is main factor
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ixfd64 on November 06, 2013, 05:58:28 am
In that case, it might be an idea to have the forwarder ship the camera separately from the rest of the package.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 06, 2013, 06:02:56 am
but there is a good chance that a brand new thermal cam with all accessories in unopened box together with receipts will attract enough attention of customs and one will be charged vat which makes whole operation a bit pointless

it still is worth a shot if price is main factor
the E4 is a huge package .... it will almost always be X-rayed and held in customs so you need (in Europe) to add 3.2% customs and your local VAT to your costs. If you are lucky no tax but only VAT will apply, but officially (see EU regulation 314/2011 from March 2011) infrared cameras are taric 90251920 and thus 3.2%.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tnt on November 06, 2013, 06:05:45 am
Not known if framerate is changeable but no reason for it to not be baked into the FPGA, especially due to the ITAR issues.
The only thing I've seen relating to framerate is the  "Allow_30Hz" or similar message in the bootup text, but this may just be a status readout from the FPGA.

The "Is 30 Hz Allowed" message seems to be entirely driven by the "version.hw.det_board.article", "version.hw.mainboard.article" and "version.hw.mainboard.revision" keys. There seem to be several combinations that would result in a "Yes".

Of course it might be easier to just patch the binary to make it return "1" all the time ... becasue those values above could be used somewhere else to configure hw differently or something ...
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tnt on November 06, 2013, 07:23:37 am
Interestingly, just after that function is called and if it returns one, 0x1E is written to a HW register with a DeviceIOControl ...

Anybody want to give it a shot ? (I lent mine to a friend for a couple of days ...)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 06, 2013, 07:27:13 am
Not known if framerate is changeable but no reason for it to not be baked into the FPGA, especially due to the ITAR issues.
The only thing I've seen relating to framerate is the  "Allow_30Hz" or similar message in the bootup text, but this may just be a status readout from the FPGA.

The "Is 30 Hz Allowed" message seems to be entirely driven by the "version.hw.det_board.article", "version.hw.mainboard.article" and "version.hw.mainboard.revision" keys. There seem to be several combinations that would result in a "Yes".

Of course it might be easier to just patch the binary to make it return "1" all the time ... becasue those values above could be used somewhere else to configure hw differently or something ...
I still think that is about hardware reporting to the software what it can do, rather than controlling anything.
May be interesting to look at differences in teh Ex0 firmware.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tnt on November 06, 2013, 07:36:30 am
Mmm, as I mentionned above, the config seems to trigger an explicit HW/FPGA register write. Of course, that doesn't mean the hw could actually handle it, but at least it's not just doing a print. The result does really trigger a hw action.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ViciousPest on November 06, 2013, 07:37:39 am
Ok going through the video more thoroughly. Where is the FPGA data stored? Is it stored in the same flash chip?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: olsenn on November 06, 2013, 07:40:19 am
Assuming that FLIR is on to us, how long do you suspect it would take them to patch the hardware such that it can no longer (easily) be hacked? I mean could the next batch be immune? Or does this kind of hardware/software fix take months to finish and re-test etc?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tnt on November 06, 2013, 07:43:03 am
Assuming that FLIR is on to us, how long do you suspect it would take them to patch the hardware such that it can no longer (easily) be hacked? I mean could the next batch be immune? Or does this kind of hardware/software fix take months to finish and re-test etc?

Adding hw security would take a while.

But patching the fw for the most obvious holes could probably be done fairly quickly (i.e a couple of weeks would be more than enough) if they put the resources to do it.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ixfd64 on November 06, 2013, 07:43:14 am
General Tools offers a 160 x 120 camera with a 30 Hz refresh rate for less than $2,000: http://www.generaltools.com/GTI10--predator-Series-Thermal-Imaging-Camera_p_1856.html (http://www.generaltools.com/GTI10--predator-Series-Thermal-Imaging-Camera_p_1856.html)

They also have two other 160 x 120 cameras that are more expensive but have more features, as well as a 384 x 288 unit for less than $5,500. This might be something to look into if you're seeking a higher frame rate. I wouldn't be surprised if the GTi10 could be hacked in a similar fashion.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: PA0PBZ on November 06, 2013, 08:03:08 am
The "Is 30 Hz Allowed" message seems to be entirely driven by the "version.hw.det_board.article", "version.hw.mainboard.article" and "version.hw.mainboard.revision" keys. There seem to be several combinations that would result in a "Yes".

I can't get a value for "version.hw.det_board.article", is that just me?

"version.hw.mainboard.article" returns T198283, "version.hw.mainboard.revision" returns 10 (probably 1.0)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tnt on November 06, 2013, 08:10:21 am
I can't get a value for "version.hw.det_board.article", is that just me?

"version.hw.mainboard.article" returns T198283, "version.hw.mainboard.revision" returns 10 (probably 1.0)

Looking at the code, you probably only get either mainboard or det_board depending on the model ...

You could try setting version.hw.mainboard.article to 1196597  and the revision to 2  (and I mean 2 not 20).
But as I said it might be better to patch the function to return 1 because changing those config could have other effect at other places ...

in appcore.exe, modify the 4 bytes at 0x001016ec from "05 00 a0 e1" to "01 00 a0 e3"

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ViciousPest on November 06, 2013, 08:40:23 am
Someone correct me if I'm wrong:

I would venture that the bootloader needs to be investigated. Their might be a argument loaded into the kernel that gives it its identity. Can someone please post a text dump of the output mike got in the video. I tried pausing but I couldn't identify the bootloader.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tnt on November 06, 2013, 08:48:42 am
* AFAIK, not easy to check the FPGA -> CPU path because it's all BGA. The sensor output happen to be exported to a test connector.
* The downsampling could be in the FPGA and still be configurable by software.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ViciousPest on November 06, 2013, 08:57:59 am
Hmm. Have you tried killing appcore.exe? When mike put it in "service mode" did the sample rate increase?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ViciousPest on November 06, 2013, 09:09:58 am
Odd. Maybe some sort of watch dog. Its weird because appcore isnt running when the device boots up. Im not home now but will investigate further upon arrival.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 06, 2013, 09:16:08 am
Killing appcore doesn't crash, just stops the main app running.
There are stopapp and restartapp batch files to start & stop - they are slightly misleading as they include lines to kill  a bunch of stuff than never runs - presumably leftovers from debugging.
Appcore spawns a number of other processes - FVD is run early but not sure if before or after appcore is launched by applaunch.dat

 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: CesarEscudero on November 06, 2013, 09:17:51 am
Is there anyway FLIR can patch this hack? I want to buy one but, unfortunately,  not this year...  :'(

As mentionned earlier ... yes, plenty of ways. Especially for new camera. But even if you updated the fw on a old one there is plenty of things they could do.

Would it be un-hackable ? Doubtful, but they could make it really painful and then you'd need motivated people that don't already have an hacked one to get to work on it ... Actually now that I think on it, doing it only for new cam might be a good technique ... I'm sure several people (me for eg) wouldn't spend any time looking at bypassing a new protection scheme if the old bypass kept working on my camera ...

Too bad, I can't afford it right now.


 :palm:  :palm: Never mind... I just ordered one  :palm:  :palm:


Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ViciousPest on November 06, 2013, 09:29:08 am
Mike quick question for further reference.
What methodology did you use to determine whether pin was input or output using pullup/pulldown resistors?

I understand the concept but how did you choose the value (strong vs weak?) or what if it was a GPIO (software configured, can be driven, pulled, high z?)
Just trying to get some insight for future targets  :) Thank you.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 06, 2013, 09:46:30 am
Mike quick question for further reference.
What methodology did you use to determine whether pin was input or output using pullup/pulldown resistors?

I understand the concept but how did you choose the value (strong vs weak?) or what if it was a GPIO (software configured, can be driven, pulled, high z?)
Just trying to get some insight for future targets  :) Thank you.
First stab is typically to look at how the pin voltage changes when pulled up or down with a 1K resistor - an output won't change much, an input will.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 06, 2013, 09:49:05 am
If it remains the same 100% of the time, it's either an input, a voltage supply, or a ground.
Or an output that you've not yet discovered the purpose of, or missed a brief pulse on, or only chnages under circumstances you've yet to discover. Easy enough to see how it reacts to a pullup/pulldown to be more sure.


Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 06, 2013, 09:51:15 am
If it remains the same 100% of the time, it's either an input, a voltage supply, or a ground.
Or an output that you've not yet discovered the purpose of, or missed a brief pulse on, or only chnages under circumstances you've yet to discover. Easy enough to see how it reacts to a pullup/pulldown to be more sure.
First step is usually to find all grounds using continuity tests with power off. If only to eliminate pins.
Then look for continuity to any obvious power supplies, again to narrow down search for interesting stuff.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: manu on November 06, 2013, 10:49:25 am
Thank you for the trick!
But, how do you manage to dare opening quite costly optics stuff without being feared of failing?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: TopLoser on November 06, 2013, 11:05:31 am
But, how do you manage to dare opening quite costly stuff without being feared of failing?

Feel the fear and do it anyway  :)

My first thought every afternoon when I wake up lol
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: manu on November 06, 2013, 11:26:51 am
But, how do you manage to dare opening quite costly stuff without being feared of failing?

Feel the fear and do it anyway  :)

My first thought every afternoon when I wake up lol
;D
The true question is: "where do you get these equipments for tearing down?". I got one of these cameras as a loan, but I would not tear it down regarding the caution the distributor was asking.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: olsenn on November 06, 2013, 02:06:31 pm
http://www.filedropper.com/flire4 (http://www.filedropper.com/flire4)

Here's an archive of all the FLIR Ex information I could find. May be useful having it all in one location.

It has firmware v1.18.7 as well, so perhaps you can downgrade if FLIR does ship your camera with firmware that blocks the hack
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: olsenn on November 06, 2013, 02:31:45 pm
Quote
http://www.filedropper.com/flire4

Here's an archive of all the FLIR Ex information I could find. May be useful having it all in one location.

It has firmware v1.18.7 as well, so perhaps you can downgrade if FLIR does ship your camera with firmware that blocks the hack


In edlens.asp, could these values tell you the part number and serial of the lens to see if the E4 and E8 are different?

   
Quote
         restreeLens.setResourceValue( "version", Request.Form( "lensversion" ) );
                restreeLens.setResourceValue( "SN", Request.Form( "lensserial" ) );
                restreeLens.setResourceValue( "PN", Request.Form( "lenspart" ) );
                restreeLens.setResourceValue( "focLen", Request.Form( "lensfoclen" ) );
                restreeLens.setResourceValue( "fNumber", Request.Form( "lensfnumber" ) );
                restreeLens.setResourceValue( "clearanceDistance", Request.Form( "lenscleardist" ) );
                restreeLens.setResourceValue( "rotMirr", Request.Form( "lensrotmirr" ) );
                restreeLens.setResourceValue( "opticalMinMeasRadius", Request.Form( "lensminmeasrad" ) );
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 06, 2013, 07:32:10 pm

In edlens.asp, could these values tell you the part number and serial of the lens to see if the E4 and E8 are different?

   
Quote
         restreeLens.setResourceValue( "version", Request.Form( "lensversion" ) );
                restreeLens.setResourceValue( "SN", Request.Form( "lensserial" ) );
                restreeLens.setResourceValue( "PN", Request.Form( "lenspart" ) );
                restreeLens.setResourceValue( "focLen", Request.Form( "lensfoclen" ) );
                restreeLens.setResourceValue( "fNumber", Request.Form( "lensfnumber" ) );
                restreeLens.setResourceValue( "clearanceDistance", Request.Form( "lenscleardist" ) );
                restreeLens.setResourceValue( "rotMirr", Request.Form( "lensrotmirr" ) );
                restreeLens.setResourceValue( "opticalMinMeasRadius", Request.Form( "lensminmeasrad" ) );
I would guess this is as the software is beeing used for several Flir models, even the ones with exchangable lenses.
I looks like the lenses of E4 / E8 are identical. At least the size is identical but the material might differ. Need to do the same shot at the same time with both cameras and then a comparison of the two pictures.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on November 06, 2013, 07:36:31 pm
Need to do the same shot at the same time with both cameras and then a comparison of the two pictures.
And then swap out the lenses and do another comparison. ;)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 06, 2013, 07:40:57 pm
Need to do the same shot at the same time with both cameras and then a comparison of the two pictures.
And then swap out the lenses and do another comparison. ;)
If there are differences seen - yes, then a lens swap should be made.... no need to change them back >:D
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 06, 2013, 07:45:32 pm
Thank you for the trick!
But, how do you manage to dare opening quite costly optics stuff without being feared of failing?
I am sure Mike, as most of us, did open new devices every since he can remember. Probably has something to do with genes. Thats why we are here on EEVblog and not here: http://www.pinterest.com/julia/mens-fashion/ (http://www.pinterest.com/julia/mens-fashion/)  :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on November 06, 2013, 07:46:27 pm
If there are no differences seen, then yes a swap should be made. :P It just depends on how systematic you want to test. But hey, you're the lucky bastard with both an E4 and an E8, so you get to decide the test method.  ;D
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on November 06, 2013, 07:49:57 pm
I am sure Mike, as most of us, did open new devices every since he can remember. Probably has something to do with genes. Thats why we are here on EEVblog and not here: http://www.pinterest.com/julia/mens-fashion/ (http://www.pinterest.com/julia/mens-fashion/)  :)
That website sucks. It doesn't include a "doesn't require ironing" score, so how on earth are you supposed to make an informed decision?  :P
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 06, 2013, 07:56:21 pm
Some Ex0 model would be nice to check what's beeing used as WLAN / BT ;)
I wouldn't be surpised if the double-digit series cameras would be built around the same core design - display and sensor specs look identical to me. :-/O
(in my imagination it's even a similar/same/"differently bonded" core as used in the Quark products - but note 17µ(640x) vs. 25µ(320x) difference in tech-spec)

It's horribly expensive to produce a chip just for one small batch of products - the more sold units can use the same components, the better... just look at the date of the sensor-die... clearly a modern design just fabricated for the E-series ... I'm dead sure that applies to the default lens as well!

Where the E8 model really differs: you get an additional battery and a nice charger for the couple extra grands.... ;)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on November 06, 2013, 08:15:53 pm
Some Ex0 model would be nice to check what's beeing used as WLAN / BT ;)
I wouldn't be surpised if the double-digit series cameras would be built around the same core design - display and sensor specs look identical to me. :-/O

Wouldn't surprise me either. With a bit of luck they use it as bluetooth uart with bspserial. If so, then even if you couldn't get the exact same module you would probably still be able to rig up something decent. That said, it would be really nice if someone could check what bluetooth module is being used in the higher end models.

Quote
Where the E8 model really differs: you get an additional battery and a nice charger for the couple extra grands.... ;)
Does it include one of those oxygen free usb cables?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 06, 2013, 09:07:10 pm
If there are no differences seen, then yes a swap should be made. :P It just depends on how systematic you want to test. But hey, you're the lucky bastard with both an E4 and an E8, so you get to decide the test method.  ;D
No, I do not have an E8. I thought, at a company I know, they would have an E8 but I learned on Monday it is only an E6. I tried to lend it for a day, but they did not want to give it away  :-[
Maybe my contact just had a bad day. I will try this again in a week or so.

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 06, 2013, 09:09:04 pm
Just some notes regarding "Exportable framerates" (taken from simlar specsheet):
7.5 Hz (NTSC 30/60Hz) = factor 60Hz div 8
8.3 Hz (PAL 25/50Hz) = factor 50Hz div 6

EDIT: Measured update rate@display: 9 Hz

... and my E4 has just arrived!
Code: [Select]
.version.swcombination.fullver text "os16.0.10_appkit1.0.13_prodkit1.0.0.7"
.version.swcombination.ver text "1.18.7"

@64bit drivers: they auto-add windows-firewall-rules to allow inbound connections to flir processes

Update: mod successful
@Comparison.png: images blown out of scale by my software :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: solarbot on November 06, 2013, 10:04:24 pm
TOTALLY AWESOME - thanks Mike.

Worked on my E4.10 with Firmware 1.19.8
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: eliocor on November 06, 2013, 11:08:41 pm
Just ordered a brand new E4:
total amount (taxes+s/h included) = 978 Euros.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on November 06, 2013, 11:16:17 pm
Regarding differences between the E4 and E8. They may use the same microbolometer and lens, but Mike has highlighted the presently unexplained doubling of thermal differential resolution in the E8. I recall that during Mike's OS investigations he saw two microbolometer modules listed. It is possible that the higher specification units do have a different, higher spec, Micro-bolometer fitted.

I must say that the 0.06 degrees Celcius E8 specification is impressive for a relatively cheap unit with an uncooled Micro-bolometer detector, as opposed to a cryo cooled semiconductor type. My best (megabux) FLIR uncooled industrial camera is spec'd at 0.08 Degrees C  thermal differential resolution. I may be wrong here, but IMHO lens size sets the sensitivity of the camera system, but would not influence the differential Temp detection capability of the detector.

Either FLIR hobble the E4 and E5 units to lower temperature resolution or a different detector is used in the E6 and E8 units.

At the end of the day, 0.15 Degrees Celcius temperature resolution is very respectable in a sub $1000 unit, and is the same as my Circa 1997-2000 $40k FLIR PM570. The PM570 is not considered insensitive to temperature differential in industry and has served well over the years. More modern cameras from FLIR acieve far greater thermal resolution (~30mK) but at significant retail cost.

For info:

FLIR PM570 - 1st Generation uncooled micro-bolometer - Differential temerature resolution = 0.15 Degrees.
FLIR PM695 - 3rd Generation uncooled micro-bolometer - Differential temperature resolution= 0.08 Degrees.
FLIR P65- 3rd Generation uncooled micro-bolometer - Differential temperature resolution= 0.08 Degrees.
FLIR E40-  ? Generation uncooled micro-bolometer - Differential temperature resolution= 0.07 Degrees.
FLIR E60- ? Generation uncooled micro-bolometer - Differential temperature resolution= 0.05 Degrees.

The lenses of the E40 ans E60 are far smaller than the large aperture lenses fitted on the PM and P series cameras yet they produce better thermal resolution figures. I think anyone looking for better thermal resolution in the E4 should remove the lens from their equation, unless they also desire greater overall system thermal sensitivity, for greater range (distance) operation.




 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 06, 2013, 11:30:07 pm
Regarding differences between the E4 and E8. They may use the same microbolometer and lens, but Mike has highlighted the presently unexplained doubling of thermal differential resolution in the E8.

IMHO it's probably much simpler: marketing guy + add noise function for lower end models
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: muvideo on November 06, 2013, 11:53:16 pm
Just ordered a brand new E4:
total amount (taxes+s/h included) = 978 Euros.

Hello, did you buy it in Italy?

Fabio.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on November 07, 2013, 12:09:40 am
I must say that the 0.06 degrees Celcius E8 specification is impressive for a relatively cheap unit with an uncooled Micro-bolometer detector, as opposed to a cryo cooled semiconductor type. My best (megabux) FLIR uncooled industrial camera is spec'd at 0.08 Degrees C  thermal differential resolution. I may be wrong here, but IMHO lens size sets the sensitivity of the camera system, but would not influence the differential Temp detection capability of the detector.

I am a total thermal imaging n00b, but the bit of reading I did gave me the impression that ... well, what you said! XD Very nice temperature resolution for this type of sensor. That was another reason I could tell myself I really had to buy this nice bit of gear. ;)

Do you know if for uncooled microbolometers there are any improvements to be had by making sure the sensor has very uniform temperature. Or maybe by cooling the sensor below ambient.

Another way of putting this: do you have any links to reading material so I can RTFM on this type of sensor?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: eliocor on November 07, 2013, 12:16:43 am
Yes and no.
I bought it from a VERY respectable vendor: the Italian branch of Omega (http://it.omega.com/) (but the shipping will be made from UK).
Strangely you can not find the E4 directly, but using the code (found on the German Omega site) OSXL-E4 you can make the order.
The price paid was (shipping from the UK, so VAT was 20%):
800.00 Euros - Flir E4
15.00 Euros - S/H
163.00 Euros - VAT (20%)
------------
978.00 Euros - total amount

The transaction went OK and I have already received the order confirmation*.
Shipping should be done on 2013-11-13 (1 week as defined in the order page)

To my knowledge, here in Italy the default E4 price is 995 Euros (VAT excluded)

*) hoping to not receive a call stating the order is void...  ::)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 07, 2013, 12:34:54 am

OT: ... meanwhile Dave is getting robbed by FedEx for the FLIR review he did ... https://twitter.com/eevblog/status/397976002711658496  :palm:
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: TopLoser on November 07, 2013, 12:35:28 am
Wow..... thanks Eliocor!! I just bought one for 665 GBP plus 9 GBP shipping. And I'm in England, no idea where it's shipping from!

Description           Quantity   Item Value   Item Tax   Item Total   Line Total
OSXL-E4 - FLIR E4   1           665.00           0.00           665.00           665.00
Carriage Charge                                                                   9.00
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: bookaboo on November 07, 2013, 12:38:58 am
Whaaaat??
Did you order from outside the EU? I suspect there may still be VAT to add to that.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: TopLoser on November 07, 2013, 12:40:41 am
Whaaaat??
Did you order from outside the EU? I suspect there may still be VAT to add to that.

I quoted my VAT registration number during the order process, no VAT to pay.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on November 07, 2013, 12:41:50 am
Mr fibble,

I can assit on your question.

Micro-bolometers are often temperature stabilised using an integrated peltier module. Some newer micro=bolometers have dispensed with the Peltier based temperature stabilisation. I am not sure whether the E series FPA has a Peltier module but I suspect that it has.

There is no advantage in adding additional cooling to the sensor as you will confuse the temperature stabilisation loop. The built in peltier module would try to counteract your external cooling and would draw heaps of current ! Unlike some semiconductor based detectors, there is no need to super cool the micro-bolometer. IIRC from a conversation many years ago with FLIR, teh FPA is stabilised at +30 Degrees Celcius. This may be why the specs often state the thermal resolution at +30 Degrees C.

Take a look at this thread that I produced:

http://www.eevblog.com/forum/projects/thermal-imaging-camera-microbolometer-design-detail/msg322927/#msg322927 (http://www.eevblog.com/forum/projects/thermal-imaging-camera-microbolometer-design-detail/msg322927/#msg322927)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: olsenn on November 07, 2013, 01:20:39 am
Does anyone have the time and equipment to actually measure the sensitivity of the E4 (converted to an E8)?

Here's how FLIR does it: http://flir.custhelp.com/app/answers/detail/a_id/128 (http://flir.custhelp.com/app/answers/detail/a_id/128)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: bookaboo on November 07, 2013, 01:35:35 am
Whaaaat??
Did you order from outside the EU? I suspect there may still be VAT to add to that.

I quoted my VAT registration number during the order process, no VAT to pay.

Ahhhh, still a good price :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 07, 2013, 01:45:02 am
Fairly sure the sensor has no cooling - if it is, it's on the die.
The unit does run quite warm after a while, so not inconcievable it's warmed a little, but as the temp sensor is on the frame, this may cause thermal gradients.
However the rubber mountings, as well as providing shock protection could also provide thermal isolation from the case.
 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on November 07, 2013, 02:08:17 am
Mike,

Please see the link I provided, above. repeated here:

http://www.eevblog.com/forum/projects/thermal-imaging-camera-microbolometer-design-detail/msg322927/#msg322927 (http://www.eevblog.com/forum/projects/thermal-imaging-camera-microbolometer-design-detail/msg322927/#msg322927)

The conventional MO for temperature stabilisation of the detector is to bond the die directly to the peltier module so they become one unit with excellent thermal transfer efficiency. The die temperature is monitored by two (2) thermocouples positioned on opposite sides of the die. The chassis temperature monitoing that you found is normally the 'lens temperature' that the system uses to establish the ambient temperature. This is used in the image processing algorithms along with emissivity settings.

There are definitely micro-bolometers that do not have the peltier temperature stabilisation,l but if they are more expensive to impliment, I wouldl expect the peltier type to be fitted to a 'budget' camera. Saying that, my link includes a link to an Indigo article circa 2006 detailing a non stabilised micro-bolometer.  :-//
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 07, 2013, 02:18:34 am
I suppose a quick test would be to look for a change in current draw with temperature. The only place a cooler could possibly be is on the lower die.
I suppose I could look at the die with my other TIC (or even an humble IR thermometer).
Some heating or coolling may explain the ~ in front of the displayed temp figure at startup.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: 0xdeadbeef on November 07, 2013, 02:25:05 am
Flir Ex is always described to use an uncooled microbolometer as detector.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 07, 2013, 02:30:29 am
Flir Ex is always described to use an uncooled microbolometer as detector.
Quite a common term but may be used more to distinguish from stuff that needs more serious cryo-cooling.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on November 07, 2013, 03:06:43 am
Micro-bolometers are often temperature stabilised using an integrated peltier module. Some newer micro=bolometers have dispensed with the Peltier based temperature stabilisation. I am not sure whether the E series FPA has a Peltier module but I suspect that it has.
 ...

Take a look at this thread that I produced:

http://www.eevblog.com/forum/projects/thermal-imaging-camera-microbolometer-design-detail/msg322927/#msg322927 (http://www.eevblog.com/forum/projects/thermal-imaging-camera-microbolometer-design-detail/msg322927/#msg322927)

Thanks for the info!

As pointed out by others, the Ex series is listed as an uncooled microbolometer in the specs. So based on that I was more or less under the impression that there would be no Peltier. Unless it is one of those jargon thingies, where in the domain of TICs "uncooled" really means "cooled, but not insanely cooled". As in, yeah usually we use liquid helium, but today we'll make do with a simple peltier so puny mortals can actually afford this device.

Another reason I was guessing the E4 doesn't have a peltier ... in Mike's video I didn't see any obvious wires for the supply. Unless of course it's a really wimpy peltier integrated right under the die and only using 0.00001 mA or so. ;)

But if it does have active temperature control, it would be a bad idea to mess with the control loop, agreed. It was more like, suppose there is no active temperature control, is there anything that can be done to improve temperature uniformity across the die and by that hopefully being able to get some more resolution. That is of course assuming that the ADC has enough resolution to make use of this. If not ==> forgeddaboutit.

Anyways, probably not practical, but just thinking aloud.

As for the 60 fps matter, it's a bit of a toss-up. It depends entirely how they re-used their IP for the fpga. There's a chance that you can simply set the downsampling, and there's a chance the 9 fps downsampling rate is fixed in this particular .bit files for the fpga. I did take a look at the various .bit files for the Ex and Exx series, and well, see previous. The low end of the Exx series actually has a slightly smaller bit file. Which I translate to: has similar or slightly lower complexity logic. As in, they do the 60 fps in a slightly smaller (or exactly the same) device, so no reason for it not to include 60 fps there. And when you think about it, to average/decimate frames from 60 to 9 fps you need more logic, not less.

So IFF they used the same IP for the Ex and Exx series, there's a pretty good chance that the bitstream for E4 is capable of doing 60 Hz. It really depends on the whims of your local friendly Flir developers.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Misco Jones on November 07, 2013, 03:19:40 am
I bought a E4 last week and I seen the hack to convert it to E8 but I have fear that it may stop working.

Is there any way to make a backup before or returning the firmware to the original version once applied the patch.

Thanks in advance.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 07, 2013, 03:28:32 am
I bought a E4 last week and I seen the hack to convert it to E8 but I have fear that it may stop working.

Is there any way to make a backup before or returning the firmware to the original version once applied the patch.

Thanks in advance.
No reports of any issues from many successful hacks so far.
You can backup files if you want using USB RNDIS and FTP using Filezilla
The hack does not alter any file on the device, it just adds a single file which overrides the default configuration- removing this file reverts it to normal E4 mode.
 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on November 07, 2013, 03:53:22 am
To be clear on the terms used.... A cryo cooled TIC cools the detector to an insane approx. -200 Degrees Celcius. It does this with a Stirling engine cooler charged with Helium. Many have asked the question whether such a mechanical cooler could be replaced with a Peltier stack. Sadly the answer is no. The losses and physics of the Peltier stack preclude such a temperature differential at normal ambient levels on earth. I used to use Liquid Nitrogen in cameras so the Stirling cooler is a great step forwards compared to that. The maintenance cost and noise generated by the cooler are the two big drawbacks to cryo cooling, not to mention the high power consumption.

The 'uncooled' detector is called such because it does not need to be cooled to cryogenic temperature levels in order to produce useful data. The Cryo cooled detectors produce nothing useful at ambient temperatures due to their internal heating and noise. The cryogenic temperatures reduce such to levels where by the output is actually lower noise than a micro-bolometer. For scientific work Cryo-cooling is often the way to go.

The large down side to micro-bolometers is that they are basically an array of thermistors. As many will know, thermistors are used as temperature sensors as they change value with temperature. The problem is, the temperature inside a TIC changes and the die of the micro-bolometer also includes electronics that produce heat. This all adds up to a micro-bolometer that has pixel outputs straying all over the place without an image presented to them. To 'tame' the micro-bolometer, it is actually HEATED to 30 degrees Celcius and held at that temperature by a Peltier module. If the die gets too hot, it is cooled, if it gets too cool, it is heated. It is not, however considered to be a 'cooled' detector, just temperature stabilised.

Not all semiconductor based thermal imaging arrays need to be Cryo cooled. The BST detector array is such a device. These predate the Micro-bolometer and some may say they are superior. They fell behind in development when the US Govt pulled the funding. Micro-bolometers were the 'new tech' and the US Govt put the funding into that, and developed it into what you are using today. It must be remembered that this technology originally had two major uses....an aid to fire fighters rescuing people in dense smoke, and an aid to killing your enemies on the battlefield ! It is an odd world we live in but warfare and Military matters often lead to investment in technology and its rapid advancement which hopefully benefits many.

I hope this helps to explain the situation a little clearer.

The current needed to control the die temperature is not as much as you might think. The die's thermal mass is low. The Peltier module wires on my Microbolometer are actually quite thin. I will add a photo. They are the white ptfe insulated wires in the image. The PM695 draws around 1A when operating and she is an old girl in comparison to the E series, full of power hungry discrete IC's and motors ! The Peltier module normally only has to compensate for die self heating and small changes in ambient and at 30 Degrees is only around 10 degrees or so above comfort level for humans. I you take it to the Arctic or somewhere else cold, it is a different matter  ;D it will have to work harder so battery life may be reduced.


Please look at the attached Patent document that shows the construction of micro-bolometers.

Also, please take a look at the document that is found here: (Chapter 4)

http://archives.njit.edu/vol01/etd/1990s/1997/njit-etd1997-027/njit-etd1997-027.pdf (http://archives.njit.edu/vol01/etd/1990s/1997/njit-etd1997-027/njit-etd1997-027.pdf)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: G0HZU on November 07, 2013, 03:58:02 am
Mine arrived OK and has the 1.18.8 firmware. The camera is surprisingly useful in 80x60 mode already especially with the MSX enabled.

What is the latest procedure for the mod? Do I still pm Mike for this?

I've been using the Irisys camera today at work so it will be interesting to see how the modded E4 compares. At the moment the E4 looks very noisy and snowy in 80x60 but I'm hoping it will be a different story in 320x240...

Thanks :)

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 07, 2013, 04:58:42 am
To 'tame' the micro-bolometer, it is actually HEATED to 30 degrees Celcius and held at that temperature by a Peltier module. If the die gets too hot, it is cooled, if it gets too cool, it is heated. It is not, however considered to be a 'cooled' detector, just temperature stabilised.

In pratice at everyday temps you could probably save cost and just use a heater, maybe to slightly over 30 deg.

This may explain whey I could see a 'hot' when the E4 looks at the lens of my FireFLIR
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 07, 2013, 04:59:47 am
Mine arrived OK and has the 1.18.8 firmware. The camera is surprisingly useful in 80x60 mode already especially with the MSX enabled.

What is the latest procedure for the mod? Do I still pm Mike for this?

I put a link to the most recent hack in the first post of this thread.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: olsenn on November 07, 2013, 05:06:50 am
Mike, are you (or anyone else) still working on a 30/60Hz hack?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Misco Jones on November 07, 2013, 05:11:37 am
Mike, thank you !!!!!

I don't think to return to E4 anymore !!

There is a "little difference" before the hack.

Regards.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 07, 2013, 05:13:12 am
Mike, are you (or anyone else) still working on a 30/60Hz hack?
Nope, but at some point I will be hooking up the raw sensor feed to a monitor - probably not for a while though as too busy with work.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tnt on November 07, 2013, 05:28:36 am
Mike, are you (or anyone else) still working on a 30/60Hz hack?

I posted a hack to try out a couple pages ago, but I don't think anyone gave it a shot.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: okent on November 07, 2013, 06:08:00 am
Add one more sold to the list.
Purchased one just now and should have it by Friday.
Thanks to Mike and everyone for the outstanding work done here.
Look forward to hacking my unit and enjoying great resolution at a great price.

Also look forward to seeing if anyone can figure out how to get 30/60hz. 8)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: CesarEscudero on November 07, 2013, 06:10:20 am
Note that the last version of FLIR Tools is  FLIR Tools+ 4.0 (4.0.13284.1003)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 07, 2013, 06:19:25 am
Also look forward to seeing if anyone can figure out how to get 30/60hz. 8)
Well, is this really important? For me it is quick enough, but maybe there are application-areas where this is needed.

At least for me, it would be much more important to get bluetooth or WIFI. As the Flir E4 boots up including the bluetooth code (you can see this in the debug-windows which pops up if you press middle joystick button during cold start), it might be only a matter of soldering a connector to the unpopulated areas on the PCB (and then getting hand on such a module for connecting it of course). I wonder if the E40 has such extra modules installed.

Anybody with an Exx want to join in with a teardown? ...... just a second: didn't Dave had an E60?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: G0HZU on November 07, 2013, 07:35:36 am
I just did the mod on mine. It gave a scary error message on bootup but seems to be in the higher resolution mode.

With the 320x240 enabled it's a lot better than it was :)

However, it doesn't perform as good as the Irisys 4010 for closeup stuff. eg looking at SMD stuff on PCBs because the image looks very fuzzy and soft.

Is there an easy way to adjust the focus for closeup work?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 07, 2013, 07:38:05 am
Is there an easy way to adjust the focus for closeup work?
Just screw out the lens - check the video Mike did - it is not difficult, but if you do not want to remove the front cover you need to build yourself a tool to be able to turn the lens.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ixfd64 on November 07, 2013, 08:06:46 am
I just did the mod on mine. It gave a scary error message on bootup but seems to be in the higher resolution mode.

What was the message?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: olsenn on November 07, 2013, 08:22:28 am
Quote
What was the message?

It said, "All your base are belong to us!"
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: G0HZU on November 07, 2013, 08:31:20 am
Unfortunately my finger was hovering on the buttons and the message was only brief.

It came up as a messagebox saying there was a fatal error. But it then went away.

It could be that I followed the instructions too literally because I didn't turn off the camera before removing the battery. Was this wrong?

Could this have caused the error?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ixfd64 on November 07, 2013, 08:45:41 am
Mike, I think it might be a good idea to include the steps to undo the hack in the instructions just in case someone needs to send in their camera for repairs.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 07, 2013, 08:49:48 am
I've got a question regarding Hack#3 via FW-Update in conjunction with RNDIS:

It's still a bit unclear to me whether the FW-Update will work after adding a file to switch USB into RNDIS mode... is there a way back without need for the serial console?

I'd love to poke around the camera's inner workings (telnet etc) without bricking it :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: G0HZU on November 07, 2013, 08:58:41 am
I guess I should have filmed it during the reboot.

It seems to be working OK but I was quite alarmed when it gave that message with 'fatal error' included.
This message was on the camera screen and not the PC.

Maybe the next person to do this should film the reboot sequence in case it happens to someone else too.

No Flir tools came with the camera and I downloaded these from Flir and installed them. Was this correct?
I also zipped the flashfs folder tree with the camera.cmd file included outside the folder. Was this correct?

I put the CRC in exactly as per the screen. i.e. the letters displayed in the check were lower case and I entered them as per the instructions with CRC in uppercase but I used lower case for the actual letters inside the CRC because this is how it appeared on the PC screen. Was this correct?

I think the mod instructions need a fair bit of work if this mod goes mainstream because some people will get confused (more than me?).  A video 'howto' would be the best method to show how to do it or failing this a decent word doc with screenshots of every stage :)


Title: Re: Flir E4 Thermal imaging camera teardown
Post by: georges80 on November 07, 2013, 09:20:51 am
Excellent hacking job by all concerned and especially Mike.

Funny thing: I've been keeping an eye out for an inexpensive (but good) TIC for some time... obviously without luck :)

Then I saw the E4 on some sites and did some research and then found Mike's vid & tear down vid. Was pretty convinced that the E4 would be 'ok' for my needs. I design LED driver boards and felt it would be a great tool for verifying component temps and thermal paths versus the spot IR fluke I have or thermocouple measurements.

Then just two days google search found this thread while still trying to convince myself to purchase the E4. This thread of course was an instant sell and I'll be receiving my new E4 tomorrow (staying home to make sure I'm there to sign for it).

cheers,
george.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 07, 2013, 09:36:38 am
-snip-
I think the mod instructions need a fair bit of work if this mod goes mainstream because some people will get confused (more than me?).  A video 'howto' would be the best method to show how to do it or failing this a decent word doc with screenshots of every stage :)

Sounds all fine - esp. if you have the E8 featues now - just don't worry.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: G0HZU on November 07, 2013, 09:58:49 am
-snip-
I think the mod instructions need a fair bit of work if this mod goes mainstream because some people will get confused (more than me?).  A video 'howto' would be the best method to show how to do it or failing this a decent word doc with screenshots of every stage :)

Sounds all fine - esp. if you have the E8 featues now - just don't worry.

Yes it's a decent TC now. I guess if anyone else sees the same fatal error message they don't need to panic too much :)

I'm getting better results from it now for PCB stuff because I've used the 'lock' feature on the temperature scale. i.e. I hold a soldering iron set to 100degC  just out of shot and use it to set the upper range before locking the range. This makes a PCB look less bloomy if there is a small hotspot.

In terms of using it casually to wander around and look at 'stuff' it is miles ahead of the older 160x120 Irisys 4010 camera because the Irisys needs constant manual focussing and this can be a real chore.

The screen update rate seems quicker on the E4 too. Also it is very quiet. The 4010 makes a really loud noise when gating. it really is as if the camera is hollow inside and a marble drops from the top of the camera to the bottom of the handle. Clonk! Clonk! and you can feel the clonk as if it is a falling marble too. The Flir E4 is very quiet by comparison. It looks and feels good too.

The 4010 camera is very big boxy by comparison and not as well balanced either. It looks a bit odd as well.

I just need to sort the closeup stuff on the E4. I think I can make a tool on my T-Tech 7000S CNC machine for this.
It is normally used for PCB milling but it can also make tools from flat materials.

http://t-techtools.com/store/ (http://t-techtools.com/store/)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 07, 2013, 10:06:09 am
Is there an easy way to adjust the focus for closeup work?
Just screw out the lens - check the video Mike did - it is not difficult, but if you do not want to remove the front cover you need to build yourself a tool to be able to turn the lens.
I will do a vid on this at some point. One option is to screw out the lens, but needs a tool to do it as it's hard to physically get hold of. The lens is lightly held by the rubber surround, so it can be turned but will stay where it's put.
Another option is to use a cheap CO2 laser cutter lens in front - a 20mm dia 50mm FL lens works pretty well - again I will show this in a vid - I mounted the lens in a plastic disc, retained with a wire clip
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 07, 2013, 10:09:18 am
I've got a question regarding Hack#3 via FW-Update in conjunction with RNDIS:

It's still a bit unclear to me whether the FW-Update will work after adding a file to switch USB into RNDIS mode... is there a way back without need for the serial console?

I'd love to poke around the camera's inner workings (telnet etc) without bricking it :)
Yes. You can add USBMODE RNDIS to the camera.cmd file, and it will enable it but only til a restart.
For permanently enabling RNDIS you can add the rndis.rsc config file to the appcore.d\factory.d folder, but probably need to prefix the filename with a z (=zrndis.rsc) to make it override the default setting.
You can remove the hack and/or permanent RNDIS with a camera.cmd using the delfile command - this is shown earlier in the thread - I'll add some .fif  files to do these when I get a chance.   
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 07, 2013, 10:14:48 am
I guess I should have filmed it during the reboot.
If you press any key during startup you do see a small scroling window showing bootup messages as wmall white text on a black background. I've never seen any fatal messages though.
Quote
No Flir tools came with the camera and I downloaded these from Flir and installed them. Was this correct?
I also zipped the flashfs folder tree with the camera.cmd file included outside the folder. Was this correct?
yes.
BTW may be worth keeping an eye on the Flir tools version in case Flir slip a "fix" in . Flirinstallnet.exe I have is 29/08/2013, length 237,888.
Quote
I put the CRC in exactly as per the screen. i.e. the letters displayed in the check were lower case and I entered them as per the instructions with CRC in uppercase but I used lower case for the actual letters inside the CRC because this is how it appeared on the PC screen. Was this correct?
Yes.
Quote
I think the mod instructions need a fair bit of work if this mod goes mainstream because some people will get confused (more than me?).  A video 'howto' would be the best method to show how to do it or failing this a decent word doc with screenshots of every stage :)
Go for it. I'm too busy to write baby steps instructions.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: G0HZU on November 07, 2013, 10:19:38 am
One other quick question:
Was I correct to unplug the battery directly rather than switch off the camera first? It did seem a bit odd to pull the battery but I did what the instructions said in case turning it off caused it to cancel the process.


Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 07, 2013, 10:25:22 am
One other quick question:
Was I correct to unplug the battery directly rather than switch off the camera first? It did seem a bit odd to pull the battery but I did what the instructions said in case turning it off caused it to cancel the process.
I do this all the time (to be the first who find out how to get to the secret menu - without any success yet). No problem at all until now.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 07, 2013, 10:30:06 am
Another option is to use a cheap CO2 laser cutter lens in front - a 20mm dia 50mm FL lens works pretty well - again I will show this in a vid - I mounted the lens in a plastic disc, retained with a wire clip
Cool idea!!!! You mean something like Ebay item #230838327998 (50mm FL then) would be what we need?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: csshih on November 07, 2013, 10:34:47 am

Excellent hacking job by all concerned and especially Mike.

Funny thing: I've been keeping an eye out for an inexpensive (but good) TIC for some time... obviously without luck :)

Then I saw the E4 on some sites and did some research and then found Mike's vid & tear down vid. Was pretty convinced that the E4 would be 'ok' for my needs. I design LED driver boards and felt it would be a great tool for verifying component temps and thermal paths versus the spot IR fluke I have or thermocouple measurements.

Then just two days google search found this thread while still trying to convince myself to purchase the E4. This thread of course was an instant sell and I'll be receiving my new E4 tomorrow (staying home to make sure I'm there to sign for it).

cheers,
george.
Thought your name was familiar. I signed up (about time!) just to say "+1"! I'll be using mine for thermal analysis on LED drivers too :)

Excellent job, Mike!

Craig
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on November 07, 2013, 10:35:26 am
Mike,

Nice work with mounting the ZnSe CO2 laser lens  :)

You state you used a 20mm x 50mm FL lens....wow that is close-up to the action ! The ones I bought were 100mm FL as I wanted a bit of distance between me and the target in case close up access was not possible, like when looking inside an equipment chassis. I will be very interested to see the images that your lenses produce as they are far better matched to the lens of the E4 than any of my TIC's. My primary lenses are all 30mm or greater diameter.

I think I will buy some 50mm FL lenses as well. I bought a GaAs lens to play with as well. It came from the same supplier and cost a little more. On the down side it's bandwidth is lower and its transmission is a lot lower than the ZnSe lenses. On the plus side it is a far harder material so less easily scratched. These lenses are pretty good value at $30 though.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on November 07, 2013, 10:42:48 am
PeterK13,

I bought my CO2 laser lenses from here:

http://www.ebay.co.uk/itm/ZnSe-GaAs-Focal-Lens-for-10-6um-Co2-Laser-Engraver-Cutting-Machine-12-25mm-1-4-/321078811086?pt=LH_DefaultDomain_0&var=&hash=item4ac1c9d9ce (http://www.ebay.co.uk/itm/ZnSe-GaAs-Focal-Lens-for-10-6um-Co2-Laser-Engraver-Cutting-Machine-12-25mm-1-4-/321078811086?pt=LH_DefaultDomain_0&var=&hash=item4ac1c9d9ce)

The bi-convex lens acts much like a jewellers Loupe for the camera. The FL sets the distance that the target should be placed in front of the lens. The image is then in focus at that distance and passed to the cameras primary lens without the need for additional optics. very simple and effective. My Inframetrics close-up lens is a positive meniscus type so that must have advantages but the bi-convex works OK as well. 

I bought 19mm ZnSe lenses that fit into old camera filter holders. These lenses work well and I hope Mike will get good pictures with his. I am impressed with Mikes clever filter holder to fit his E4.  :-+

As I have stated in my last message, I bought 19mm x 100mm FL lenses as that gave me a nice 4" stand-off from the PCB and decent field of view.

My Inframetrics professional close-up lens has a 6" FL which is favoured for general close-up work. I couldn't find a cheap ZnSe lens with that FL as they are designed for use in Laser cutters, and that is usually done at relatively close range.

As a side note. The thermal camera manufacturers normally use Germanium close up lenses and charge many thousands of dollars for them. Owning both I can confirm that , for hobby use, the ZnSe lenses are more than up to the task.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 07, 2013, 10:51:02 am
From some very quick tests I found 50mm was a good compromise
The figures I got were :
Lens FL / focus distance from front of rubber housing  / width of field of view
100mm  / 80mm / 60mm
50mm / 40mm / 35mm
25mm / 25mm / 20mm

As FOV is nominally about 60 deg, the focus distance and field of view is roughly the same as the lens focal length

An improvement on the plastic disc would be a disc of 1.6mm PCB, slightly oversized with some long slots machined to form a couple of springy arms to hold it in place, plus a couple of screws/studs to allow fingers to grip to squeeze to release tension.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: okent on November 07, 2013, 10:53:10 am
Also look forward to seeing if anyone can figure out how to get 30/60hz. 8)
Well, is this really important? For me it is quick enough, but maybe there are application-areas where this is needed.

At least for me, it would be much more important to get bluetooth or WIFI. As the Flir E4 boots up including the bluetooth code (you can see this in the debug-windows which pops up if you press middle joystick button during cold start), it might be only a matter of soldering a connector to the unpopulated areas on the PCB (and then getting hand on such a module for connecting it of course). I wonder if the E40 has such extra modules installed.

Anybody with an Exx want to join in with a teardown? ...... just a second: didn't Dave had an E60?

9hz is not bad but I have spent some time behind 30 and 60hz units and it's more functional for panning.  For stationary objects the 9hz is just fine.  This will be more for a hobby/fun unit and higher frame rate would be awesome.

I am wondering where wifi or bluetooth would be helpful.  Maybe file transfers for pictures through the unit?

Has anyone tried using this for things at a distance?

Mine gets here Friday!!!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 07, 2013, 10:57:17 am
I've updated the Hack details post (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg321956/#msg321956) with a new zip that includes scripts to unhack, and also install/remove permamnt RNDIS and enable temporary RNDIS.

BTW the FLIR install tool works fine over RNDIS - it auto-detects. You probably need the RNDIS driver there though.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: G0HZU on November 07, 2013, 10:59:29 am
I'd be very interested to see the results using the lenses as I'd much rather use a lens than fiddle with the mechanics of the existing lens.

I mainly want this camera for PCB work as I often have to make sure that components don't get too hot in circuit.

I do RF design for a living so a typical use for me will be looking at the performance of high power PIN diode switch designs when driven with high power into a poor load or for looking at the RF power handling of RF filter designs or even just looking at individual components. eg to see how hot a DC blocking cap gets when passing high power at maybe 4GHz. I need to be able to see SMD components really clearly.

The old Irisys 4010 was just about adequate for this but I'm really hoping the E4 will be better.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 07, 2013, 11:03:49 am
Yes. You can add USBMODE RNDIS to the camera.cmd file, and it will enable it but only til a restart.
For permanently enabling RNDIS you can add the rndis.rsc config file to the appcore.d\factory.d folder, but probably need to prefix the filename with a z (=zrndis.rsc) to make it override the default setting.
You can remove the hack and/or permanent RNDIS with a camera.cmd using the delfile command - this is shown earlier in the thread - I'll add some .fif  files to do these when I get a chance.   

ok, managed to create a FIF file wich temporarily puts the cam into RNDIS mode (not USBMODE but usbfn)
Beware: the driver installation resets all standing TCP connections due to the installation of the new interface.

Had to add at least a file to make the .fif beeing accepted by the transfer tool.

The attachment needs to be renamed in order to be useable (forum extention filter)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 07, 2013, 11:05:37 am
I've updated the Hack details post (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg321956/#msg321956) with a new zip that includes scripts to unhack, and also install/remove permamnt RNDIS and enable temporary RNDIS.

thanks - overlapping work/posts :)

Web-Interface link: http://flir:3vlig@192.168.0.2/service/index.asp (http://flir:3vlig@192.168.0.2/service/index.asp)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on November 07, 2013, 11:07:34 am
With regard to auxiliary close up lens mounting. I have been considering using a suitable diameter clip on lens cap. The type with two sprung buttons. Some have a nice large central area that can be cut to take the lens mount. My camera is somewhat different to the E4 though and I am not sure how well a lens cap would clip into the E4 lens orifice. 

Mike, My PM570's and PM695's have 24 Degree FOV primary lenses. That explains why I have settled on the 100mm FL auxiliary lens compared to your 50mm for the E4's wider FOV of 45 degrees.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 07, 2013, 11:10:57 am
I suppose a quick test would be to look for a change in current draw with temperature. The only place a cooler could possibly be is on the lower die.
I suppose I could look at the die with my other TIC (or even an humble IR thermometer).
Some heating or coolling may explain the ~ in front of the displayed temp figure at startup.

A very crude test with a cheap IR thermometer suggests the sensor is heated to somewhere between 30 to 35 deg.C, after which time the "~" disappears from the display

What I really need is another calibrated TIC to check... My FireFLir always autoranges so no use for measurements  (I wonder if there is a serial console in there...)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 07, 2013, 11:19:52 am
A very crude test with a cheap IR thermometer suggests the sensor is heated to somewhere between 30 to 35 deg.C, after which time the "~" disappears from the display
What I really need is another calibrated TIC to check... My FireFLir always autoranges so no use for measurements  (I wonder if there is a serial console in there...)

How about checking the inbuilt sensors?
http://192.168.0.2/service/TDRIFT/Sensors.asp (http://192.168.0.2/service/TDRIFT/Sensors.asp)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Fraser on November 07, 2013, 11:26:11 am
My very crude 'lash-up' for testing the usability of the ZnSe lenses for close-up work may be found here:

http://www.eevblog.com/forum/crowd-funded-projects/m-thermal-imager-real-or-fake/msg302859/#msg302859 (http://www.eevblog.com/forum/crowd-funded-projects/m-thermal-imager-real-or-fake/msg302859/#msg302859)

I believe the performance will likely be better on the E series as my PM695 Primary lens is almost 60mm diameter and it is looking through a19mm auxiliary lens ! Not really a good match  :palm:
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 07, 2013, 11:32:57 am
A very crude test with a cheap IR thermometer suggests the sensor is heated to somewhere between 30 to 35 deg.C, after which time the "~" disappears from the display
What I really need is another calibrated TIC to check... My FireFLir always autoranges so no use for measurements  (I wonder if there is a serial console in there...)

How about checking the inbuilt sensors?
http://192.168.0.2/service/TDRIFT/Sensors.asp (http://192.168.0.2/service/TDRIFT/Sensors.asp)
I've not really played much with service mode...
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 07, 2013, 11:36:17 am
I've not really played much with service mode...
It's even cooler - there's a button to enable service mode - by default it warns that the cam is not in service mode - but one can access all the live sensor data - it even auto-updates.

btw - I had a strange happening when going to noise cal ... the whole screen went noise-cluttered (IR only) - a cold boot removed that :) .. not sure what happened (I didn't start any cal process btw)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 07, 2013, 12:11:44 pm
I've not really played much with service mode...
It's even cooler - there's a button to enable service mode - by default it warns that the cam is not in service mode - but one can access all the live sensor data - it even auto-updates.

btw - I had a strange happening when going to noise cal ... the whole screen went noise-cluttered (IR only) - a cold boot removed that :) .. not sure what happened (I didn't start any cal process btw)

Had that happen when fooling around with the i7's internal serial ports -- had to unplug it from everything and reboot.
I've seen a screen full of very coarse noise a couple of times when the sensor board got partially unmplugged.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 07, 2013, 12:22:24 pm
INFO: \\192.168.0.2 (CIFS) works in IP-mode - access to images without FTP :)
Also: \\192.168.0.2\root$ and \\192.168.0.2\windows$

EDIT: MUST READ:
http://support.flir.com/DocDownload/Assets/75/English/T559504$A.pdf (http://support.flir.com/DocDownload/Assets/75/English/T559504$A.pdf)
Chapter 1.3.3 (following pages are also - contains valueable info on commands etc.)
Note: the PDF is for another camera, but most information applies to the Ex series in IP mode as well!

Open Ports:
Code: [Select]
TCP TABLE
            Loc Addr   Loc Port
             0.0.0.0         21
             0.0.0.0         23
             0.0.0.0         80
             0.0.0.0        139
             0.0.0.0        443
             0.0.0.0      22136
             0.0.0.0      22176
             0.0.0.0      22177
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: digsys on November 07, 2013, 01:07:47 pm
I keep feeling beady lawyers eyes staring at me every time I read this thread ... is there a way to save the whole thread?
... Just in case  :-)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 07, 2013, 01:09:10 pm
I keep feeling beady lawyers eyes staring at me every time I read this thread ... is there a way to save the whole thread?
... Just in case  :-)
Print button helps a lot, then you just need to fetch yourself the missing attachments + linked documents :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 07, 2013, 01:19:43 pm
collateral password finding: "www.flir.com" has been used in some former models via a hidden menu (strg-shift-a) - chance of it beeing reused? :)

EDIT:
Note on the sensor-naming ( ISC0901B0 ):
I'm pretty sure the first two numbers (09) are the sensor's generation year - deduced from some documents found online where that # went form 98 to 00 to 05 and 09 now... ;) the next pair of numbers beeing the resolution/model and then followed by special features.
Unfortunately "our" ROIC isn't listed here: http://www.flir.com/cvs/cores/view/?id=51948 (http://www.flir.com/cvs/cores/view/?id=51948)

EDIT2: root:3vlig is a working login (verified for ftp)

EDIT3: .system.webpasswd text "IRCAM" ... another possible password
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: okent on November 07, 2013, 03:26:49 pm
Proactively downloaded flir tools just now.
It's a 581MB file, version shows last updated October 15, 2013.
flirinstall.exe is still showing 8/29/2013 with 233kb size.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 07, 2013, 05:48:13 pm
Good news everyone:
Quick notification in advance:
The camera HAS a working manual temperature mode *verified*!  ;D ;D ;D

ALPHA AND SEVERELY CRASHING - the attached file is NOT perfect - it should be tried only by advanced users !!!
replace \FlashBFS\system\ui.d\toolbar-config_Z3.xml with the modded one (rename) over FTP and perform a cold cam-reboot - you'll have several additional features (didn't have time to test all the menus - for example "measurement" has some issues and will crash when selecting a cerain menu item)!

EDIT: BE WARNED: the attached config will cause crash of appcore on bootup once "stuck"

Updated attachment, adds palettes, manual mode and some trash - only for advanced users - install via FTP


If you'd like to experiment yourself then take a look at the strings of those files:
\FlashBFS\system\ui.d\languages\<file>
\FlashBFS\system\facet_ui_qml.dll

Maybe there's a way to restart facet without cold restart... I also did some documenting on the shell calls - but not ready for release yet.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Zoltan von Negrow on November 07, 2013, 06:13:58 pm
Next Monday, I will test hacked E4 on calibrated black body. Only to know, that hack doesn´t affect calibration. (Due to calibration was made for E4)


There is no reason for decalibration. But for sure!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: equinoxe on November 07, 2013, 06:39:23 pm
Good news everyone:
Quick notification in advance:
The camera HAS a working manual temperature mode *verified*!  ;D ;D ;D

ALPHA AND SEVERELY CRASHING - the attached file is NOT perfect - it should be tried only by advanced users !!!
replace \FlashBFS\system\ui.d\toolbar-config_Z3.xml with the modded one (rename) over FTP and perform a cold cam-reboot - you'll have several additional features (didn't have time to test all the menus - for example "measurement" has some issues and will crash when selecting a cerain menu item)!

BE WARNED: the attached config will cause crash of appcore on bootup once "stuck"

If you'd like to experiment yourself then take a look at the strings of those files:
\FlashBFS\system\ui.d\languages\<file>
\FlashBFS\system\facet_ui_qml.dll

Maybe there's a way to restart facet without cold restart... I also did some documenting on the shell calls - but not ready for release yet.

Could it be that it crashes because you have to activate the measurement first/instead?
Because some are disabled in the E8.cfg file.. ( I already mentioned it a few pages back (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg321493/#msg321493) )
I noticed some of the config strings are disabled, and these are (I have sorted them, they are not in the same spot in the E8.cfg file):

.caps.config.image.sysimg.irMarkers.box.enabled bool false
.caps.config.image.sysimg.visualMarkers.box.enabled bool false

.caps.config.image.sysimg.irMarkers.spot.enabled bool false
.caps.config.image.sysimg.visualMarkers.spot.enabled bool false

.caps.config.image.sysimg.measureFuncs.mcircle.enabled bool false

.caps.config.image.sysimg.measureFuncs.mline.enabled bool false

.caps.config.image.sysimg.measureFuncs.isotherm.dual bool false
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 07, 2013, 06:43:14 pm
Could it be that it crashes because you have to activate the measurement first/instead?
Because some are disabled in the E8.cfg file: I already mentioned it a few pages back (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg321493/#msg321493)
I noticed some of the config strings are disabled, and these are (I have sorted them, they are not in the same spot in the config file):

Nah, I did enable them btw...

Right now I'm struggling to get the appcore noncrashing again - seems to be persistance of last mode used that bites my ass...
... just hope they didn't store that in the sqllite DB :)
But disabling the options might also help... *I'll give it a try* ;)



this helped: rset .image.sysimgInstances.main.measureFuncs.diff.1.active false
(I had dumped the whole config in case I need a known good state to compare to) :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: equinoxe on November 07, 2013, 07:06:48 pm
[...]
Nah, I did enable them btw...

Right now I'm struggling to get the appcore noncrashing again - seems to be persistance of last mode used that bites my ass...
... just hope they didn't store that in the sqllite DB :)
But disabling the options might also help... *I'll give it a try* ;)



this helped: rset .image.sysimgInstances.main.measureFuncs.diff.1.active false
(I had dumped the whole config in case I need a known good state to compare to) :)

Cool! I am curious how much extra functions this beast has, and whether we are able to add them.
Would be awesome to be able to update a stock from E4 to an E8++ with more functions than the pricy stock E8 has.. :P
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 07, 2013, 07:14:14 pm
Cool! I am curious how much extra functions this beast has, and whether we are able to add them.
Would be awesome to be able to update a stock from E4 to an E8++ with more functions than the pricy stock E8 has.. :P
basically it's a mix of the binaries and the ressource files - my first attempt was just using the strings from the menu config - but then I remembered and took a look at one of the more advanced camera firmwares... structure is similar...  :)

those two are present in our E4 binary, but definately causing the crash:
      <ToolBar name="measure_delta_s"/>
      <ToolBar name="measure_delta_t"/>

some other menus seem to depend on hardware buttons ... but some functions can be simply remapped I think.... work in progress :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 07, 2013, 07:33:13 pm
I bought 19mm ZnSe lenses that fit into old camera filter holders. These lenses work well and I hope Mike will get good pictures with his. I am impressed with Mikes clever filter holder to fit his E4.  :-+
Aurora: could you please make a photo of such a filter holder please (or post a link to one)? I tried to find such a thing but was not successful.
Thanks
Edit: I made the mistake to search for 19mm and lens, but obviously you need to search for 19mm and filter. I assume an item like Ebay 231080131443 would be the correct one? Or better something like Ebay 151124311796?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 07, 2013, 08:19:58 pm
I bought 19mm ZnSe lenses that fit into old camera filter holders. These lenses work well and I hope Mike will get good pictures with his. I am impressed with Mikes clever filter holder to fit his E4.  :-+
Aurora: could you please make a photo of such a filter holder please (or post a link to one)? I tried to find such a thing but was not successful.
Thanks
Edit: I made the mistake to search for 19mm and lens, but obviously you need to search for 19mm and filter. I assume an item like Ebay 231080131443 would be the correct one? Or better something like Ebay 151124311796?

Ebay search for co2 lens will find plenty of options around £20

Mostly ZnSe but also some GaAs - not sure which would be better but ZnSe generally cheaper
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 07, 2013, 08:32:25 pm
I bought 19mm ZnSe lenses that fit into old camera filter holders. These lenses work well and I hope Mike will get good pictures with his. I am impressed with Mikes clever filter holder to fit his E4.  :-+
Aurora: could you please make a photo of such a filter holder please (or post a link to one)? I tried to find such a thing but was not successful.
Thanks
Edit: I made the mistake to search for 19mm and lens, but obviously you need to search for 19mm and filter. I assume an item like Ebay 231080131443 would be the correct one? Or better something like Ebay 151124311796?

Ebay search for co2 lens will find plenty of options around £20

Mostly ZnSe but also some GaAs - not sure which would be better but ZnSe generally cheaper
Yes, it is easy to find those - but I am looking for this 19mm filter holder Aurora is mentioning which allows to integrate the sensible ZnSe lens.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 07, 2013, 09:14:41 pm

This is working now:

not working yet: video mode, rainbow-high-contrast, annotations, zoom
several symbols are missing, but text is shown when selecting them

See my initial posting for the updated zip:
http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg324950/#msg324950 (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg324950/#msg324950)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mjl on November 07, 2013, 10:03:51 pm
Another E4 sales commission for Mike :)

For those keeping score: serial 63905xxx, firmware version 1.18.8, calibration cert says FLIR Estonia, Oct 28 2013. Ordered last week (conrad.nl).
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 07, 2013, 10:59:39 pm

This is working now:
  • PIP in two sizes (small size is new)
  • Color:
    • Greyscale inverted
    • Humidity mode
    • Insulation mode
    • Interval mode
    • Arctic
    • Lava
  • Manual temperature scale setting

not working yet: video mode, rainbow-high-contrast, annotations, zoom
several symbols are missing, but text is shown when selecting them

See my initial posting for the updated zip:
http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg324950/#msg324950 (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg324950/#msg324950)
Is this still crashy or does it work reliably?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: amyk on November 07, 2013, 11:34:16 pm
I suppose a quick test would be to look for a change in current draw with temperature. The only place a cooler could possibly be is on the lower die.
I suppose I could look at the die with my other TIC (or even an humble IR thermometer).
Some heating or coolling may explain the ~ in front of the displayed temp figure at startup.

A very crude test with a cheap IR thermometer suggests the sensor is heated to somewhere between 30 to 35 deg.C, after which time the "~" disappears from the display

What I really need is another calibrated TIC to check... My FireFLir always autoranges so no use for measurements  (I wonder if there is a serial console in there...)
So the opposite of an "uncooled microbolometer" is a "heated microbolometer"...

Are there mirrors that reflect IR? Maybe you could have it look at itself?

Quote
not working yet: video mode
Although it's only 320x240 the flash in the E4 isn't that big - the size was mentioned a few pages back - so it probably can't record for very long.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 07, 2013, 11:35:50 pm
Is this still crashy or does it work reliably?

mild problems at max - worst I had was that I had to hold power 2x in a row for >5s
-> happened in mode color_iso_insulation ... possibly some hickup with initial parameters

when setting "rset .ui.userSettings.advancedMeasureMenu true" then the measurement menu looks different, but little use.
I had some tests and got even delta measurements to work - but not much fun.

Regarding the hidden menu: I found some traces for it:
Code: [Select]
  <ui_model type="HiddenServiceSettingsModel" name="hiddenServiceSettingsModel">
    <ui_model_item type="SettingItem" ID="USB_MODE" label="ID_SETUP_USB_MODE" nextModel="usbModeSettingsModel" nextQML="SettingsPage.qml" settingType="entry" />
    <ui_model_item type="SettingItem" ID="EXPORT_INFO" label="ID_SETUP_EXPORT_INFO" />
    <ui_model_item type="SettingItem" ID="VERSION_INFO" label="ID_SETUP_VERSION_INFO" nextModel="versionSettingsModel" nextQML="SettingsPage.qml" settingType="entry" />
  </ui_model>

  <ui_model type="USBModeSettingsModel" name="usbModeSettingsModel">
    <ui_model_item type="SettingItem" ID="MSD" label="MSD" radio="true"/>
    <ui_model_item type="SettingItem" ID="UVC" label="UVC" radio="true"/>
    <ui_model_item type="SettingItem" ID="RNDIS" label="RNDIS" radio="true" />
    <ui_model_item type="SettingItem" ID="RNDIS_UVC" label="RNDIS and UVC" radio="true"/>
    <ui_model_item type="SettingItem" ID="RNDIS_MSD" label="RNDIS and MSD" radio="true"/>
    <ui_model_item type="SettingItem" ID="UVC_MSD" label="UVC and MSD" radio="true" />
    <ui_model_item type="SettingItem" ID="RNDIS_UVC_MSD" label="RNDIS, UVC and MSD" radio="true"/>
  </ui_model>
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 08, 2013, 12:07:30 am
Thanks Aurora !
Do they have an extra screwed ring to hold the lens inside the holder? Edit: this is probably what you mean with "front ring"?

Another option is to use a cheap CO2 laser cutter lens in front - a 20mm dia 50mm FL lens works pretty well - again I will show this in a vid - I mounted the lens in a plastic disc, retained with a wire clip
Mike, you call this clamping thing "wire clip". I think this is a clever idea to use! It is reliable, cheap and easy to install and to remove.
I have seen this kind of clamp before of course, but cannot find it now to order somewhere. Sometimes you just do not know what to search for. Any idea what the "official" name is or where to get this?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 08, 2013, 12:17:44 am
Is this still crashy or does it work reliably?

for Mike: the attached .zip contains a special "settings" menu where the hidden menu is added visibly as 5th element top the options menu
the menu label and symbols are dupe as the ressource seems to be lacking matching texts/icons.

originally the hidden menu is set to be only reached as "next" item from the camera information subpage ... but no idea what triggers the menuflip!

Please note: the zip contains a .bmp without backup (yet) ... it will change the bootup screen a small bit (special edition)

ah - and btw - the hidden menu contains an USB settings menu :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 08, 2013, 12:22:47 am

Quote
not working yet: video mode
Although it's only 320x240 the flash in the E4 isn't that big - the size was mentioned a few pages back - so it probably can't record for very long.
..and the CPU may not have the power to compress in realtime
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 08, 2013, 12:41:47 am
Ok Peopes........ I am sorely tempted to add an E4 to my collection of TICs. I am not a business, so sadly will have to Pay VAT no matter where I buy it. Are there any fellow Brits who have a recommendtion for the best/cheapest place to buy from in the UK ? I know stocks are in short supply (thanks to Mike  ;D ) but any tip woudld be apprecited as I am  looking fo a good deal if one exists.

Fraser
Seems nobody advertises anything below RRP so probably need to ask around for best price/stock. I think the issue ATM is finding any stock, let alone price. I notice tequipment in US sold not only 12 E4s but also a couple of E5's in the 24hrs after the hackaday post
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: TopLoser on November 08, 2013, 12:47:30 am
Ok Peopes........ I am sorely tempted to add an E4 to my collection of TICs. I am not a business, so sadly will have to Pay VAT no matter where I buy it. Are there any fellow Brits who have a recommendation for the best/cheapest place to buy from. I know stocks are in short supply (thanks to Mike  ;D ) but any tips would be apprecited as I am  looking fo a good deal if one exists.

I bought one yesterday from www.omega.co.uk (http://www.omega.co.uk), it was listed online for £665+VAT.

Today it's £795+VAT...
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 08, 2013, 12:58:14 am
Ok Peopes........ I am sorely tempted to add an E4 to my collection of TICs. I am not a business, so sadly will have to Pay VAT no matter where I buy it. Are there any fellow Brits who have a recommendation for the best/cheapest place to buy from. I know stocks are in short supply (thanks to Mike  ;D ) but any tips would be apprecited as I am  looking fo a good deal if one exists.

I bought one yesterday from www.omega.co.uk (http://www.omega.co.uk), it was listed online for £665+VAT.

Today it's £795+VAT...
Yeah, I just wanted to propse Omega to Aurora too but checked the price before. I then thought I remembered wrong. But obviously not. Thats the law of supply and demand.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 08, 2013, 01:02:14 am
Ok Peopes........ I am sorely tempted to add an E4 to my collection of TICs. I am not a business, so sadly will have to Pay VAT no matter where I buy it. Are there any fellow Brits who have a recommendation for the best/cheapest place to buy from. I know stocks are in short supply (thanks to Mike  ;D ) but any tips would be apprecited as I am  looking fo a good deal if one exists.

I bought one yesterday from www.omega.co.uk (http://www.omega.co.uk), it was listed online for £665+VAT.

Today it's £795+VAT...
Yeah, I just wanted to propse Omega to Aurora too but checked the price before. I then thought I remembered wrong. But obviously not. Thats the law of supply and demand.
So I'm not the only one who thought I saw a lower price there..
Probably worth calling them though
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: eliocor on November 08, 2013, 01:22:50 am
I think I was lucky: 800€ instead of 955€!!!
It is just curiosity, but other than TopLoser and me, have anyone else bought an E4 from Omega?
Maybe the surge of requests triggered some list price alarms!!! ;)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: olsenn on November 08, 2013, 01:29:13 am
So I am a tad confused about all this talk about different lenses and service menus et cetera. I was under the impression that seperate lenses couldn't be attached to the E4, or is this a mod?

Is there any reason to go into the service menu (or whatever it's called); does it unlock any new features of the camera that the hack doesn't do?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: BravoV on November 08, 2013, 01:37:48 am
I shall have to be patient  :)

... sometimes that will be rewarded with a prize ... errr... comes with a price ...  >:D
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 08, 2013, 01:42:10 am
So I am a tad confused about all this talk about different lenses and service menus et cetera. I was under the impression that seperate lenses couldn't be attached to the E4, or is this a mod?
A simple mod - like adding spectacles 8)
Quote
Is there any reason to go into the service menu (or whatever it's called); does it unlock any new features of the camera that the hack doesn't do?
Not as far as we know, unless you want to modify break the calibration of your unit.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: 0xdeadbeef on November 08, 2013, 01:45:25 am
Some pictures with ZnSe lenses of different focus lengths would be welcome. I understand 0.5m is the minimum focus distance with the standard lens.
Yet 50mm (2") focus length seems very small. I wonder if  63.5mm (2.5"), 76.2mm (3") or even 100mm (4") wouldn't work better.
Besides: some dealers on eBay sell "HQ"  ZnSe lenses for roughly twice the price of the normal ZnSe lenses. They seem to have lower transmission losses.
I wonder if that makes much of a difference for thermal imaging purposes...
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 08, 2013, 01:47:11 am
@Taucher and any other Windows CE experts.

May I note a minor request? Maybe it is pretty easy to do.

The E4 is a fixed focus camera, beeing able to show sharp pictures from 30cm to inifinity.
But the internal real picture camera can show sharp pictures up to 10cm or even closer (I tried). It is the infrared sensor (and lens) which is limited to 30cm.

For distances between 3m and 30 cm the parallaxis between the sensor picture and the camera picture is being corrected by shifting pixels in the vertical axis. This is selected in the distance menu.

Now, by rotating the lens or by adding an additional CO2 laser lens (ZnSn) it would be possible to check anything closer than 30cm. A PCB check with 10cm distance for example would be possible now which gives us a much higher resolution.

Unfortunately the pixels of the internal camera will not be shifted enough with the lowest (30cm) option, as the settings are limited to 0.3m / 0,6m / 1m .... >3m. Thus the usage of MSX is not possible.

Now the question: Do you think there is any way to add another option to that list: "0,1m"?
The current list should be stored somewhere including a table with the amount of pixels to be shifted. For 10cm another 35 pixels need to be added (rough guess now).
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: olsenn on November 08, 2013, 01:47:56 am
Quote
A simple mod - like adding spectacles

Yes, I know it would be simple; just adding some double-sided adhesive tape and sticking another lens on there would probably work; however, do you take the old lens out first, or do you add one over top of the other (like sunglasses on top of your prescription glasses)? Thermal polarizer anyone? har de har har

 
Quote
Not as far as we know, unless you want to modify break the calibration of your unit.

My unit hasn't even shipped yet, but I will not be opening it. I was just curious to see what has been found in all these secret menus.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 08, 2013, 01:49:28 am
Just spoke to Omega. No Dice. They are sticking to their GBP795 price. From the reaction of the nice lady on the phone, me thinks a pricing error occurrred !
Or Flir insisted that they keep to RRP or they would not receive new E4s.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: kaz911 on November 08, 2013, 01:54:57 am
okay - for those who need ... I have gone through and gotten my freight forwarder in the US to "approve" the Ex cameras <= 9Hz for export based on Flir Export documentation and ECCN numbers. My FF is VERY hard on export control - so now it is vetted and should be "in the system" at the Freight Forwarder as allowed for export.

Due to the sensitive nature :) I'll only give the details to people who PM and have EEVBlog history - and please don't disclose to outside parties for the next week (until MY camera has shipped at least - don't want corporate big guns aiming at my Freight Forwarder *G*) - and If you will let me I can even earn $10 shipping credit by referring you :)

And a little trick... If you have a US Amazon account :) and a Freight Forwarder in the US - "sub sellers" can't verify your CC details. Amazon takes payment and they are a bit more liberal with where CC comes from. You might pay a little extra buying through Amazon (As in closer to RRP) - but you can usually buy from people who would not touch a non-US CC.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: m4rkiz on November 08, 2013, 02:18:26 am
It looks like they come in 35mm and 50mm diameters.

bit harder to install and remove but plenty of sizes available

www.ebay.ie/sch/i.html?_odkw=c+clip&_osacat=0&_nkw=internal+c+clip&_sacat=0 (http://www.ebay.ie/sch/i.html?_odkw=c+clip&_osacat=0&_nkw=internal+c+clip&_sacat=0)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: olsenn on November 08, 2013, 02:22:03 am
Quote
My FF is VERY hard on export control

Your profile says you are from the United Arab Emirates; that's pretty close to Iran and some other embargoes nations. I imagine shipping thermal images from there would be a bloody nightmare. Glad to hear you figured out a way though :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 08, 2013, 02:29:57 am
@Taucher and any other Windows CE experts.

May I note a minor request? Maybe it is pretty easy to do.

The E4 is a fixed focus camera, beeing able to show sharp pictures from 30cm to inifinity.
But the internal real picture camera can show sharp pictures up to 10cm or even closer (I tried). It is the infrared sensor (and lens) which is limited to 30cm.

For distances between 3m and 30 cm the parallaxis between the sensor picture and the camera picture is being corrected by shifting pixels in the vertical axis. This is selected in the distance menu.

Now, by rotating the lens or by adding an additional CO2 laser lens (ZnSn) it would be possible to check anything closer than 30cm. A PCB check with 10cm distance for example would be possible now which gives us a much higher resolution.

Unfortunately the pixels of the internal camera will not be shifted enough with the lowest (30cm) option, as the settings are limited to 0.3m / 0,6m / 1m .... >3m. Thus the usage of MSX is not possible.

Now the question: Do you think there is any way to add another option to that list: "0,1m"?
The current list should be stored somewhere including a table with the amount of pixels to be shifted. For 10cm another 35 pixels need to be added (rough guess now).
The problem is that at close distances it just isn't going to work - the geometric errors across the image will be too high - as you get closer, the cameras are not just at different distances, but looking from very different angles, so registration will vary across the field of view in both axes. For close-up work, even if it did work, MSX wouldn't be a huge benefit.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: kaz911 on November 08, 2013, 02:30:37 am
Quote
My FF is VERY hard on export control

Your profile says you are from the United Arab Emirates; that's pretty close to Iran and some other embargoes nations. I imagine shipping thermal images from there would be a bloody nightmare. Glad to hear you figured out a way though :)

UAE is not under any embargo. As the UAE has almost 10% of the worlds oil reserves the US is very nice here.... But I would not touch any kind of export to neighbour countries. Exporting restricted items here to embargo countries are punished with jail or worse.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 08, 2013, 02:32:45 am
I just joined the E4 Club  :)

I had a chat with a very friendly chap at PASS as I have dealt with them before. I explained that some companies in the USA are discounting when asked for such, and would he offer me any form of deal on an E4 ?

It would appear that UK sellers are in a tighter spot than US ones. I was told that discounts on the higher models were definitely a possibility but the margins on the low end E4 were so tight for them that they could do very little, if anything, for me on their GBP796+VAT price. PASS are discounting the E5 at the moment so they obviously do discount. It looks more and more like OMEGA made a pricing error. I pushed a little harder for a discount and exceptionally secured one based on my past good custom etc etc. I know this may all be just sales talk, but the chap did seem very friendly and genuine. He also advised that the set they sell is the complete kit including hard case for storage and full warrantly etc. I am very happy with my deal but it looks like discounts will be hard to find in the UK at the moment.

The camera is sent using a special secure delivery service to ensure that it does not go walkies in transit  :)

PASS sold two E4's today and mine is the third. They restock daily and have a batch of five arriving tomorrow. One of which will be mine. Sales are obviously going well ! FLIR must be a tad surprised at the figures ?

PASS web site:

http://www.tester.co.uk/flir-e4-thermal-imaging-camera (http://www.tester.co.uk/flir-e4-thermal-imaging-camera)

Looking forward to hacking my E4
Any comment from him re. recent E4 sales volumes and reasons for such...?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: olsenn on November 08, 2013, 02:41:21 am
I seriously hope FLIR is not onto us yet; I don't want to be getting a revision of this camera that is immune to hacking
Title: Re: Re: Flir E4 Thermal imaging camera teardown
Post by: zapta on November 08, 2013, 03:14:27 am
I seriously hope FLIR is not onto us yet; I don't want to be getting a revision of this camera that is immune to hacking

I can assure you that they track this thread from day one. Some as part of their duty and others for curiosity and fun.

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 08, 2013, 03:58:31 am
@Taucher and any other Windows CE experts.
-snip-
Now the question: Do you think there is any way to add another option to that list: "0,1m"?
The current list should be stored somewhere including a table with the amount of pixels to be shifted. For 10cm another 35 pixels need to be added (rough guess now).
The problem is that at close distances it just isn't going to work - the geometric errors across the image will be too high - as you get closer, the cameras are not just at different distances, but looking from very different angles, so registration will vary across the field of view in both axes. For close-up work, even if it did work, MSX wouldn't be a huge benefit.
May I add: there are exactly 6 pre defined fields and all are somehow linked/used inside the binaries... so: no chance - use a mirror or prism to fix alignment :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 08, 2013, 04:21:30 am
A question for those who already own an E4 and have used FLIR Tools.....

Can you change the centre temperature and span when viewing the image ? I know the E4 embeds meta data in the jpg file but wondered if it is similar to the old img file meta data

My camera produces the img files and these area read in Explorer99 and FLIR Tools. The metadata contains ALL the raw thermographic data that the camera collected so you can manipulate the image in any way you like as though it was a live image on the camera,. i.e. you can change palette, span spot temperature point etc. Does FLIR Tools provide any image data manipulation options when using the FLIR jpg files ?
Yes, you can manipulate it as you like in Flir Tools
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 08, 2013, 04:23:23 am
A question for those who already own an E4 and have used FLIR Tools.....

Can you change the centre temperature and span when viewing the image ? I know the E4 embeds meta data in the jpg file but wondered if it is similar to the old img file meta data

My camera produces the img files and these area read in Explorer99 and FLIR Tools. The metadata contains ALL the raw thermographic data that the camera collected so you can manipulate the image in any way you like as though it was a live image on the camera,. i.e. you can change palette, span spot temperature point etc. Does FLIR Tools provide any image data manipulation options when using the FLIR jpg files ?
Not looked in detail but I think you have to save a raw file - have seen references to this but not sure if this is supported (YET?) on the E4 and/or (the free version of) FLIR Tools
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ixfd64 on November 08, 2013, 04:25:07 am
Just spoke to Omega. No Dice. They are sticking to their GBP795 price. From the reaction of the nice lady on the phone, me thinks a pricing error occurrred !
Or Flir insisted that they keep to RRP or they would not receive new E4s.

In that case, it might be worth a try to ask for a rebate as opposed to a discount. That way, the distributor can technically say they sold it at the price FLIR demanded. ;D
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 08, 2013, 04:33:55 am
Yes, you can manipulate it as you like in Flir Tools
Addendum: Just download Flir Tools and try it out - its free.
Attached is a sample file from my E4 for you to try out - try to guess what it shows (without looking to the picture of the digital camera) :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ixfd64 on November 08, 2013, 04:39:21 am
A sink?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: AndyC_772 on November 08, 2013, 04:40:53 am
...and you've had the hot tap running for a little while.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 08, 2013, 04:44:17 am
...and you've had the hot tap running for a little while.
That was too easy. Yes, a sink (thanks to MSX you was able to guess it quickly).
Nice to see the reflections of the vertical sides of the sink.

Oh, and by the way: you can export the file as a CSV file from Flir Tools (I attached the pic above as a CSV export in case you are interested)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: dr.diesel on November 08, 2013, 05:04:02 am
Until this thread I had no desire to own a TIC, damn you Mike!     :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 08, 2013, 05:09:21 am
By the way Mike, what do you think of the FLIR soft case that they sent to you ? Did you have to buy it or did FLIR respond to a complaint regarding the large carry case ?
They sent it to me after I sent a link to the review & bounced a few emails back & forth re. things I raised in the review.
It's a much better option than the hard case - very well made, and noy excessively padded - doesn't need it due to the internal shock protection. Apparently both cases cost them about the same, so they said they would look again at case options.
I'm a little surprised the lowest end model even includes a case at all - I doubt many people would have complained if a case was only included in E5 & up. Just a pity they included the wrong one!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 08, 2013, 05:17:48 am
Interesting Mike.

One web site listed the 'Hard case' at GBP127 +VAT and the soft case at GBP17 +VAT  :-//

I will invest in a soft case  :)
Just check the version - I think the Ex0 and Ex may have a different case. ISTR it being more than that for the Ex one.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 08, 2013, 05:29:42 am
-snip @Case -
 Just a pity they included the wrong one!

I prefer the peli(like)case by all odds!
It would be a shame to deliver such a nice product and leave the customer alone how to store it (incl. all extra bits) once unpacked.
I'd guess everbody has a different preference on this - so if at all, then Flir could decide to offer an alternative default case option :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 08, 2013, 05:32:52 am
status update regarding menu-tweaking: rainbow-high-contrast working now
advance measurement options are a bit of a headache
... I have all .caps enabled - but maybe some are still missing.
to reload the config one can use the "restartapp" batch command - just give it the same time as a cold restart - plus: doesn't kill telnet :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: _Sin on November 08, 2013, 05:34:34 am
Not looked in detail but I think you have to save a raw file - have seen references to this but not sure if this is supported (YET?) on the E4 and/or (the free version of) FLIR Tools

The jpg file contains a massive metadata section, containing both the webcam image as another jpg, and what I assume is the raw data as 16 bit png. I've not tried parsing it yet.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ixfd64 on November 08, 2013, 05:35:11 am
Considering that so many members are ordering E4's, has anyone considered ordering a group buy?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tnt on November 08, 2013, 05:39:43 am
The exiftools ( http://www.sno.phy.queensu.ca/~phil/exiftool/ (http://www.sno.phy.queensu.ca/~phil/exiftool/) ) have support for the FLIR specific meta data and you can extract them as well. As a result you get a PNG with 16 bits data in it ... except they screwed up the byte ordering and so you can't view that PNG with normal PNG viewers ...
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on November 08, 2013, 05:57:56 am
Not looked in detail but I think you have to save a raw file - have seen references to this but not sure if this is supported (YET?) on the E4 and/or (the free version of) FLIR Tools

The jpg file contains a massive metadata section, containing both the webcam image as another jpg, and what I assume is the raw data as 16 bit png. I've not tried parsing it yet.

Yup, lots of metadata + 320x240 16-bit png + 640x480 from small camera + 320x240 thermal image.

Oh and ExifTool (http://www.sno.phy.queensu.ca/~phil/exiftool/) + ImageMagick (http://www.imagemagick.org/) == profit!

Also note this section:
http://www.sno.phy.queensu.ca/~phil/exiftool/TagNames/FLIR.html (http://www.sno.phy.queensu.ca/~phil/exiftool/TagNames/FLIR.html)

I got my E4. Shiney tooooy!  ;D For those keeping score: serial 63903xxx, and firmware 1.18.7

Oh yeah, in case anyone running linux is interested ... I made a little script that automates things a bit. You can attach your E4, run script, and then it will grab the serial number, generate E8 config file + do the CRC etc. Short version: it generates an E8_hack.fif for your specific camera. Currently you still have to use Flir Tools to run the FIF. :P

I tested it on my E4 and it worked in one go. :)


Before:
<who_cares/>

After (woohoo! 320x240):
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: madpuma13 on November 08, 2013, 06:18:54 am
status update regarding menu-tweaking: rainbow-high-contrast working now
advance measurement options are a bit of a headache
... I have all .caps enabled - but maybe some are still missing.
to reload the config one can use the "restartapp" batch command - just give it the same time as a cold restart - plus: doesn't kill telnet :)

Im very interested to see if you get this working along with your other menu/options youve worked out.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on November 08, 2013, 06:24:34 am
The exiftools ( http://www.sno.phy.queensu.ca/~phil/exiftool/ (http://www.sno.phy.queensu.ca/~phil/exiftool/) ) have support for the FLIR specific meta data and you can extract them as well. As a result you get a PNG with 16 bits data in it ... except they screwed up the byte ordering and so you can't view that PNG with normal PNG viewers ...

Doh, didn't notice you mentioned exiftools as well. Oh well, now it's double true! exiftool is darn handy. I noticed the byte order swap in the raw png. Just checking the code for it right now, and they do try to handle byte order. Lemme see if it is user error, or a bug.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tnt on November 08, 2013, 06:35:27 am
I think they handle the byte swap only when the data is raw and not PNG. When it's PNG, it just extracts the PNG data but you can't fix it without decompressing the PNG, fixing the byte order and re-compress ...
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on November 08, 2013, 06:48:33 am
Correctemundo.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 08, 2013, 07:07:37 am
My sincere thanks to all who have answered my questions and who worked to create this wonderfully simple to apply hack. I know it was a time consuming task to create. Mike, I am very grateful for your videos and for sharing your knowledge. My wife may not be so happy when she see's another thermal camera arrive at the front door....I can already hear her words in my head....."haven't you already got several of those ?" and "why do you need another"  :scared:
Maybe you should point out a similar issue with shoes, handbags, etc.... ;D
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on November 08, 2013, 07:12:28 am
I think they handle the byte swap only when the data is raw and not PNG. When it's PNG, it just extracts the PNG data but you can't fix it without decompressing the PNG, fixing the byte order and re-compress ...

Right, ImageMagick to the rescue:

Code: [Select]
exiftool FLIR012345.jpg -RawThermalImage -b | convert - -interlace none -depth 16 r:- | convert -size 320x240 -interlace none -depth 16 -endian msb gray:-  problem_solved.png

Edit: and to normalize the above result for easy viewing by a human (as opposed to further processing the 16-bit result):
Code: [Select]
convert problem_solved.png -normalize -depth 8 raw_image_relative.png
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tnt on November 08, 2013, 07:53:34 am
Edit: and to normalize the above result for easy viewing by a human (as opposed to further processing the 16-bit result):
Code: [Select]
convert problem_solved.png -normalize -depth 8 raw_image_relative.png

Oh very nice. I had found the -endian option to fix the image but didn't think of using normalize to get something usable without further processing
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: zapta on November 08, 2013, 08:50:26 am
Maybe you should point out a similar issue with shoes, handbags, etc.... ;D

How many shows and handbags does he have?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 08, 2013, 09:58:44 am
Re. ui fiddling for extra functions - it could be that some things are implemented but the keys aren't there to operate them
This is the help from the bt console command to simulate keys.  I haven't found anything yet that does anything other than normal keys though.
Quote
usage: bt <key>
usage: bt [flank] <named key>
bt -a <Key> <Alt>+<key>
bt -u       Joystick up    button
bt -d          -"-   down  button
bt -l          -"-   left  button
bt -r          -"-   right button
bt -e  <Enter>     key
bt -t  <Tab>       key
bt -c  <Esc>       key
bt -b  <Backspace> key
bt -    Minus
bt f1 - Left  function button
bt f2 - Right function button
bt -g - Laser    button
bt -s - Snapshot button
bt -o - Open (recall) image button
bt -p - Power on/off button
bt u1 - User button 1
bt u2 - User button 2
bt -m - Mode button
bt -f - Freeze button
bt -v - View mode button (IR/DC/Fusion)
bt -k - Toggle button (Viewfinder/LCD)
bt -A - Manual|Auto button
bt --   Adjust left key
bt -+   Adjust right key
bt -*   Adjust press key
bt -P  <named key> Press flank
bt -R  <named key> Release flank
bt af - Auto focus button
bt ai - focus in button
bt ao - focus out button
bt zn - Zoom near button
bt zf - Zoom far button
Character and number keys used as they are
Just bt will send a <Space>
 ------             ------
 | f1 |    -----    | f2 |
 ------    |-u |    ------
           -----
      -----     -----
      |-l |     |-r |
      -----     -----
           -----
  -----    |-d |    -----
  |-o |    -----    |-p |
  -----    -----    -----
           |-g |  (Laser)
           -----
           -----
           |-s | (Snapshot)
           -----

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 08, 2013, 10:16:20 am
Re. ui fiddling for extra functions - it could be that some things are implemented but the keys aren't there to operate them
This is the help from the bt console command to simulate keys.  I haven't found anything yet that does anything other than normal keys though.

@buttons - yes, even documented in T559504$A.pdf - chapter 2.4.2.1 - most features are pretty useless

Currently I'm on deciphering what starts what... as far as I got it seems that appcore spawns approx. 34 threads - at least one of them is facet, which builds up the menu according to a set of binary and xml data files... I'd love to add the missing icons somehow... but didn't even find where the icons reside... $%&/! compiled in ressources...

and while I'm writing: the rset/rdump tools are obviously made to ignore the "caps" tree - except one adresses an element directly :)

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 08, 2013, 10:25:01 am
Re. ui fiddling for extra functions - it could be that some things are implemented but the keys aren't there to operate them
This is the help from the bt console command to simulate keys.  I haven't found anything yet that does anything other than normal keys though.

@buttons - yes, even documented in T559504$A.pdf - chapter 2.4.2.1 - most features are pretty useless

Currently I'm on deciphering what starts what... as far as I got it seems that appcore spawns approx. 34 threads - at least one of them is facet, which builds up the menu according to a set of binary and xml data files... I'd love to add the missing icons somehow... but didn't even find where the icons reside... $%&/! compiled in ressources...

and while I'm writing: the rset/rdump tools are obviously made to ignore the "caps" tree - except one adresses an element directly :)
I think rdump will display caps.
BTW rls has a -lll option that shows permissions etc. which may be handy
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: kotaKat on November 08, 2013, 10:35:03 am
Well, I was talking to a coworker about the mod and apparently on a whim it prompted him to buy it -- and me to do the hack! ;D

Just to note, the e4hack3a.zip file doesn't have the camera.cmd file -- I had to pull it from my "backup" copy of e4hack3.zip.

I couldn't get the subject matter I had to stay still, so here's two shots to add to the before/after pool.
My lovely dog in 80x60+MSX:
(http://flupl.be/1113eqBz.jpg)
The heating and (sadly empty) beer and soda fridge in 320x240+MSX:
(http://flupl.be/1113tzGd.jpg)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 08, 2013, 10:47:29 am
Just to note, the e4hack3a.zip file doesn't have the camera.cmd file -- I had to pull it from my "backup" copy of e4hack3.zip.
Oops - fixed.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: olsenn on November 08, 2013, 10:48:20 am
I wonder if I will be able to use my, hopefully soon to arrive, E4->E8 to see if women are "in heat"! I'll bring all new meaning to FLIRting.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tnt on November 08, 2013, 11:08:12 am
Well, it's not rocket science ... I'd guess that any area that it pressed tighter against the clothes are going to transmit more heat them more and show up brighter.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: olsenn on November 08, 2013, 11:15:16 am
Maybe the good bits emit more heat in the first place :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ixfd64 on November 08, 2013, 11:24:12 am
I wonder if I will be able to use my, hopefully soon to arrive, E4->E8 to see if women are "in heat"! I'll bring all new meaning to FLIRting.

Haha, good one!

Whilst demonstrating an early Agema 880 TIC, I was under strict instructions to not point the camera at ladies. They apparently tend to glow in embarrassing places !

Now you're really giving us ideas (http://tvtropes.org/pmwiki/pmwiki.php/Main/DoNotDoThisCoolThing). ;D
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tnt on November 08, 2013, 11:48:11 am
Maybe the good bits emit more heat in the first place :)

For her sake, I hope not.

Apparently increased temperature in the breasts means increased blood flow / abnormal vascular pattern which can indicate cancer. It's actually used as a diagnostic test less invasive than mammograms.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: lewis on November 08, 2013, 11:53:52 am
So despite already owning a Ti10, ordered an E4 from Pass last night. Got a call today though saying they were out of stock until Monday. Let's see what happens!

Kudos to Mike and others for the excellent bit of reverse engineering. Send your invoices to Flir - you've earned the commission.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: CesarEscudero on November 08, 2013, 12:15:04 pm
Does anybody with experience in this kind of products.

Assuming that FLIR has already a firmware fix, how many time do other people have to buy one? Do you think that sellers that are out of stock are getting non-hackable units soon?
Most of the sites referred here are getting units in 10 days, they said...
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: plesa on November 08, 2013, 12:45:15 pm
http://www.tequipment.net/ (http://www.tequipment.net/) changed the shippng estimation for my Flir E4  few hours ago
from
To Be Shipped On 11/20/2013 (Old Estimate: 11/7/2013)
To
Shipped On 12/4/2013 (Old Estimate: 11/20/2013)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: olsenn on November 08, 2013, 12:51:25 pm
My tequipment.net order got updated this evening from "Estimated Ship Date: 11/06/2013" to "Estimated Ship Date: 11/07/2013". I honestly don't get why they would keep updating the estimated ship date to the current day if they had no plans on shipping it then. Evening if it was to ship today, just wait until it has shipped and then update the status to "shipped"
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Rasz on November 08, 2013, 02:03:10 pm
It would appear that UK sellers are in a tighter spot than US ones. I was told that discounts on the higher models were definitely a possibility but the margins on the low end E4 were so tight for them that they could do very little, if anything, for me on their GBP796+VAT price. PASS are discounting the E5 at the moment so they obviously do discount. It looks more and more like OMEGA made a pricing error. I pushed a little harder for a discount and exceptionally secured one based on my past good custom

I have a bridge to sell you.

(http://www.findingbetteragencies.com/wp-content/uploads/picture-of-a-shifty-used-car-salesman.jpg)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ron on November 08, 2013, 02:13:02 pm
 Post 524 says:

"e4hack3b.zip (102.46 kB - downloaded 2 times.)"

What's up with that?  I've downloaded it more than 2 times myself.  :-DD
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: BravoV on November 08, 2013, 02:16:29 pm
Post 524 says:

e4hack3b.zip (102.46 kB - downloaded 2 times.)

What's up with that?  I've downloaded it more than 2 times myself.  :-DD

Check post #913
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ron on November 08, 2013, 02:32:04 pm
Post 524 says:

e4hack3b.zip (102.46 kB - downloaded 2 times.)

What's up with that?  I've downloaded it more than 2 times myself.  :-DD

Check post #913

Yeah, that's why I downloaded it a 3rd time.  I didn't notice the rev. "b".
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ron on November 08, 2013, 02:41:30 pm
Does anyone else think it would be nice to get that FLIR logo of of the lower left corner of the image?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: scibit on November 08, 2013, 02:51:33 pm
http://www.tequipment.net/ (http://www.tequipment.net/) changed the shippng estimation for my Flir E4  few hours ago
from
To Be Shipped On 11/20/2013 (Old Estimate: 11/7/2013)
To
Shipped On 12/4/2013 (Old Estimate: 11/20/2013)

That sucks.
Mine still says "On Hold" :(
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ixfd64 on November 08, 2013, 02:56:42 pm
Does anybody with experience in this kind of products.

Assuming that FLIR has already a firmware fix, how many time do other people have to buy one? Do you think that sellers that are out of stock are getting non-hackable units soon?
Most of the sites referred here are getting units in 10 days, they said...

Maybe it's wishful thinking, but FLIR doesn't have much to gain by "fixing" this as most professional users of thermal cameras probably aren't going to use hacked devices. If anything, this has greatly boosted FLIR's E4 sales.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: CesarEscudero on November 08, 2013, 02:59:22 pm
Does anybody with experience in this kind of products.

Assuming that FLIR has already a firmware fix, how many time do other people have to buy one? Do you think that sellers that are out of stock are getting non-hackable units soon?
Most of the sites referred here are getting units in 10 days, they said...

Maybe it's wishful thinking, but FLIR doesn't have much to gain by "fixing" this as most professional users of thermal cameras probably aren't going to use hacked devices. If anything, this has greatly boosted FLIR's E4 sales.

I count on this, mine is on hold too  :-//
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: madshaman on November 08, 2013, 04:58:45 pm
I ordered from flir-direct.com, they claimed to have a unit in stock in Montreal.  I've never dealt with these people; hopefully I won't have the hassle of having to get my credit card company to reverse the transaction.

Anyone else do the same?  Apologies if this site has been mentioned, I'm still reading the thread and did do a forum search for them.  Honestly, I jumped right on the first non-completely-sketchy site that claimed to have stock.

(I'm also still cobbled by my bandwidth (in outskirts of Dar es Salaam).  My SO has an interview in a few days where we'll be moving to a hotel in the city centre with a decent connection, I'll have to catch up on everything then ^^')
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 08, 2013, 06:59:09 pm
I ordered from flir-direct.com, they claimed to have a unit in stock in Montreal.  I've never dealt with these people; hopefully I won't have the hassle of having to get my credit card company to reverse the transaction.
Don't worry. I ordered another 2 units there too and according to the tracking they are already in customs. Of course flir-direct.com does not mean that here Flir sells directly. As you said, it is a Canadian dealer (also owning fluke-direct.com and many other ....-direct websites).
Hint: Check out their value added package called E4-Kit= same price but you will get more for your money. By this they avoid to lower the price below RRP but give some useful extra devices for humidity, dew-point calculation etc. worth another $70..... and they give quantity discount.

Oh - and they do ship internationally without bullsh*-excuses such as "Flir does not allow" or "it is against the law".
Edit: btw: they do intl. shipping by TNT by an unbeatable price (2 E4 KIT packages for $130).

Hint 2: The more you put in you cart (starting at quantitiy of 2) the lower the price gets.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ixfd64 on November 08, 2013, 07:14:43 pm
Like I said earlier, we really need a group buy!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 08, 2013, 07:18:14 pm
Like I said earlier, we really need a group buy!
I assume: anybody interested in an E4 buys one by themselves immediately before they are out of stock everywhere and being replaced by an E4 with an "improved" firmware. It often just takes too long to settle a group buy and gather all the money. What you may do: buy 5 and sell them for +$50 each. By this you have your group buy and you are lowering the price for your own unit at the same time by $200.
Edit: you may also buy 5 now, wait a month or two (until they are not hackable anymore) and then sell then for +$500 each >:D
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 08, 2013, 08:37:03 pm
Short status update:
found the place where the icons are stored  :palm: .. rcc file in ui.d (sleeping helps a lot)
facet_z3.rcc is beeing detected by ui_control.rsc
Code: [Select]
.ui.setup.control.qml_rcc text "\FlashBFS\system\ui.d\facet_*.rcc"Flir uses a QT based frontend (Nokia QT4 libs) ... a quick binwalk (see attachment) shows locations of all used icons/graphics and "strings -e b <file>" gave some metainformation on included filenames.

If anybody has more experience in QT and resource editing: please feel free to contribute some help :)

EDIT1: http://harmattan-dev.nokia.com/docs/library/html/qt4/resources.html (http://harmattan-dev.nokia.com/docs/library/html/qt4/resources.html)
EDIT2: This looks like right direction ... use QT to load and store resources ... http://www.progtown.com/post24427765.html#p24427765 (http://www.progtown.com/post24427765.html#p24427765)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tealsuki on November 08, 2013, 08:38:24 pm
If I had more than $5 to my name (I blame Jeri Ellsworth), I'd certainly consider investing in an E4. Regardless, I'm always happy to read 63 page threads where secrets are unearthed, hacking ensues, and just a general discussion on how to make good products even better occurs.

Thanks to Mike and all the other folks in this thread!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 08, 2013, 09:13:40 pm
Short status update:
found the place where the icons are stored  :palm: .. rcc file in ui.d (sleeping helps a lot)
facet_z3.rcc is beeing detected by ui_control.rsc
Code: [Select]
.ui.setup.control.qml_rcc text "\FlashBFS\system\ui.d\facet_*.rcc"Flir uses a QT based frontend (Nokia QT4 libs) ... a quick binwalk (see attachment) shows locations of all used icons/graphics and "strings -e b <file>" gave some metainformation on included filenames.

If anybody has more experience in QT and resource editing: please feel free to contribute some help :)

EDIT1: http://harmattan-dev.nokia.com/docs/library/html/qt4/resources.html (http://harmattan-dev.nokia.com/docs/library/html/qt4/resources.html)
EDIT2: This looks like right direction ... use QT to load and store resources ... http://www.progtown.com/post24427765.html#p24427765 (http://www.progtown.com/post24427765.html#p24427765)
While I cannot help you guys with the Windows CE internals, I might be able to provide nice icons if needed. Just tell me what size you need and for what function you need it. I then can provide them if you are able to include them so CE uses them. I would also need to know if you need two icons (selected / not selected) or if CE does this automatically.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: equinoxe on November 08, 2013, 09:23:03 pm
Does anyone else think it would be nice to get that FLIR logo of of the lower left corner of the image?

Absolutely! (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg323764/#msg323764)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 08, 2013, 09:34:16 pm
Does anyone else think it would be nice to get that FLIR logo of of the lower left corner of the image?

Absolutely! (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg323764/#msg323764)
Folks... that's already on the ToDo list - and at least a binary patch should be possible without any trouble - right now I'm working on a program to unpack the .rcc files incl. the internal structure
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 08, 2013, 10:07:40 pm
And there was me thinking that the hacking of the E4 had probably reached the limits of what could be achieved. I am fascinated to read of the continued 'reverse engineering' of the OS. Most is well beyond my understanding but very interesting all the same  :)

This E4 investigation could provide much valuable insight into theses devices that was previously unavailable. It is the first such 'public domain' reverse engineering of a TIC that I have seen. KUDOS to Mike for starting this ball rolling, and for attracting other Win CE professionals to the party !

Good work guys and thank you for all your efforts
Given that most of the hard stuff is handled by the OS and the FPGA, I wonder how hard it would be to just replace their main user app completely instead of tweaking the existing one.
Title: Flir E4 Thermal imaging camera teardown
Post by: madshaman on November 08, 2013, 10:28:46 pm

I ordered from flir-direct.com, they claimed to have a unit in stock in Montreal.  I've never dealt with these people; hopefully I won't have the hassle of having to get my credit card company to reverse the transaction.
Don't worry. I ordered another 2 units there too and according to the tracking they are already in customs. Of course flir-direct.com does not mean that here Flir sells directly. As you said, it is a Canadian dealer (also owning fluke-direct.com and many other ....-direct websites).
Hint: Check out their value added package called E4-Kit= same price but you will get more for your money. By this they avoid to lower the price below RRP but give some useful extra devices for humidity, dew-point calculation etc. worth another $70..... and they give quantity discount.

Oh - and they do ship internationally without bullsh*-excuses such as "Flir does not allow" or "it is against the law".
Edit: btw: they do intl. shipping by TNT by an unbeatable price (2 E4 KIT packages for $130).

Hint 2: The more you put in you cart (starting at quantitiy of 2) the lower the price gets.

Thanks man, feel better.  I did of course buy the "E4 Kit".  Had to ship it to my friend back home; hope that doesn't confuse things.

How did you get your tracking info, did they email it to you?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: amyk on November 08, 2013, 10:48:46 pm
And there was me thinking that the hacking of the E4 had probably reached the limits of what could be achieved. I am fascinated to read of the continued 'reverse engineering' of the OS. Most is well beyond my understanding but very interesting all the same  :)

This E4 investigation could provide much valuable insight into theses devices that was previously unavailable. It is the first such 'public domain' reverse engineering of a TIC that I have seen. KUDOS to Mike for starting this ball rolling, and for attracting other Win CE professionals to the party !

Good work guys and thank you for all your efforts
Given that most of the hard stuff is handled by the OS and the FPGA, I wonder how hard it would be to just replace their main user app completely instead of tweaking the existing one.
One with a better, non-laggy UI? Might not be as hard as it sounds if it's just making API calls into the existing infrastructure. I'm quite familiar with win32 API and CE looks similar, but at the same time it's also quite different. (Bypassing all of Qt could also be a solution to eliminating the lag.)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 08, 2013, 11:01:19 pm
Thanks man, feel better.  I did of course buy the "E4 Kit".  Had to ship it to my friend back home; hope that doesn't confuse things.
How did you get your tracking info, did they email it to you?
I had to ask them and then got it by mail. They sent it out on Tuesday and it arrived in Belgium yesterday (TNT hub); the package has already passed customs (I provided TNT the "correct" Taric number, hoping that they are using it) and left Belgium towards Germany. Due to the tracking I shall reveive it Tuesday but with luck it might be Monday.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 08, 2013, 11:03:45 pm
Given that most of the hard stuff is handled by the OS and the FPGA, I wonder how hard it would be to just replace their main user app completely instead of tweaking the existing one.
One with a better, non-laggy UI? Might not be as hard as it sounds if it's just making API calls into the existing infrastructure. I'm quite familiar with win32 API and CE looks similar, but at the same time it's also quite different. (Bypassing all of Qt could also be a solution to eliminating the lag.)

Forget that guys... it would be an insanely tedious job to accomplish - for example just appcore.exe contains (really) thousands of methods... if you still want to try a complete reverse+rewrite from scratch: feel free to go ahead ;)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: amyk on November 08, 2013, 11:40:09 pm
Forget that guys... it would be an insanely tedious job to accomplish - for example just appcore.exe contains (really) thousands of methods... if you still want to try a complete reverse+rewrite from scratch: feel free to go ahead ;)
Isn't that because it is linked with Qt (which adds tons of bloat)?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: frenky on November 08, 2013, 11:41:20 pm
Does anyone else think it would be nice to get that FLIR logo of of the lower left corner of the image?

Absolutely! (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg323764/#msg323764)
Folks... that's already on the ToDo list - and at least a binary patch should be possible without any trouble - right now I'm working on a program to unpack the .rcc files incl. the internal structure

Flir logo is probably a .png or .gif file somewhere in the file system. Raplace that file with completely transparent png/gif and that should do it...
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 08, 2013, 11:41:32 pm
From using a fully fledged thermal camera, I am expecting the most annoying aspect of the E4(E8) to be the lack of centre temperature and span.
-snip-
The good news is that FLIR TOOLS allows you to change the CT and SPAN to extrat the detail. But that needs a PC and cannot be done (at the moment) on teh E4(E8)

The default firmware already contains a manual mode that works - but is just inaccessible.
If operating the camera on USB(RNDIS) or over a console then you can already use the commands "level" and "span" to set exactly what you wanted (but not in °C ... rather in binary from 0...65k)

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 08, 2013, 11:43:17 pm
Flir logo is probably a .png or .gif file somewhere in the file system. Raplace that file with completely transparent png/gif and that should do it...

See http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg325817/#msg325817 (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg325817/#msg325817)
:)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: frenky on November 08, 2013, 11:48:53 pm
I see... It could be this one: Sc_Logo_FlirHardEdges.png
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 08, 2013, 11:51:42 pm
From having used a fully fledged thermographic camera, I am expecting the most annoying aspect of the E4(E8) to be the lack of centre temperature and span buttons or menus.
Taucher's hack enables a manual scale function - left/right keys select hi/lo/both, up/down adjust values. No direct span adjust but you can achieve the same thing.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 09, 2013, 12:33:42 am
Another step accomplished - .rcc is extracted  ;D

deRcc attachment is the code used to unpack - repacking should work somehow like that
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Richard Wad on November 09, 2013, 12:43:26 am

Fr the home DIY brigade, a TIC gives an excellent insight into your homes construction. No more using awful stud finders. Use the TIC to see the wood or metal studs. The screws are very visible too. Heating and hot water piped glow through the walls.

Part of the reason I bought mine!
Having used mine for a couple weeks now I think the most aggravating thing about the E4 is still the pause and auto-calibrating.
Had suspected the additional palettes in flirtools were in the camera, glad to see those have been uncovered as well. Insulation palette is lovely. A 60hz "upgrade" would be the ultimate hack if it can be done for video purposes.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: all_repair on November 09, 2013, 12:45:19 am
>That sucks.
Mine still says "On Hold" :(

I asked after I was onhold for 1 day and was told as a 1st time overseas billing address buyer shipping  to a US addr, they need me to send them a copy of the credit card and a bill showing my card address.  I thought I got the last ex-stock piece at tequipment, but no more I think.  I am in the process of getting from Sam of valuetesters that ship international, but after a day or 2, I am still waiting for a link to pay by paypal.  If it works, they may be the one to go with.   Tequipment is not ready for the international crowd of EEVBLOG. 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: tnt on November 09, 2013, 12:46:21 am
Another step accomplished - .rcc is extracted  ;D

deRcc attachment is the code used to unpack - repacking should work somehow like that

Very nice.

Now we know that to enter the secret menu, you just need to press the "Right" key for 10 second when in the device info menu :)
From there you can change the USB modes more easily.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: frenky on November 09, 2013, 12:50:42 am
Another step accomplished - .rcc is extracted  ;D

deRcc attachment is the code used to unpack - repacking should work somehow like that

In the attachment is blank transparent logo file and a backup. If someone wants to try it out...
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 09, 2013, 12:54:24 am
Another step accomplished - .rcc is extracted  ;D

deRcc attachment is the code used to unpack - repacking should work somehow like that

Very nice.

Now we know that to enter the secret menu, you just need to press the "Right" key for 10 second when in the device info menu :)
From there you can change the USB modes more easily.

Sharp eyes :) qml/SettingsPage.qml
Code: [Select]
Timer {
        id: hiddenServiceMenuTimer
        interval: 10000
        onTriggered: {
            pageLoader.source = "SettingsPage.qml"
            greenbox.system.showHiddenMenu()    // Load any data in the menus. Somewhat hacky, but it is a special case (i.e. don't copy this idea!)
        }
    }

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on November 09, 2013, 01:00:21 am
Another step accomplished - .rcc is extracted  ;D

deRcc attachment is the code used to unpack - repacking should work somehow like that

Thanks. Also, typo in instructions. That should be qmake -project && qmake && make (not -profile).

Quote
Now we know that to enter the secret menu, you just need to press the "Right" key for 10 second when in the device info menu
From there you can change the USB modes more easily.

Nice one!  :-+ Just tested, and seems to be working. I put it on the "Camera information" page, and then right button for about 10 seconds ==> USB mode menu. Those easy access USB modes will definitely come in handy. :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 09, 2013, 01:03:25 am
OT but hopefully useful.

When my E4 arrives I will be looking for a bracket to hold it on a desk or tripod. My initial thought is to modify a commonly available hand held bar code scanner  desk stand. I will keep you informed of progress, if any !

IDEA: replacement-footplate (the thing around the battery) - shouldn't be too hard to create CNC/CAM files for a copy where a nose (for a tripod screwpoint) extends to the front
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: equinoxe on November 09, 2013, 01:04:51 am
Another step accomplished - .rcc is extracted  ;D

deRcc attachment is the code used to unpack - repacking should work somehow like that

Wow, the QML is nicely documented, love that there are comments that explain why certain code is added. ;)

[edit]
And someone found a way to hide the flir logo. :) Nice
And someone found the way to the secret menu. :)  Cool. :D
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 09, 2013, 01:06:31 am
Thanks. Also, typo in instructions. That should be qmake -project && qmake && make (not -profile).
ut 10 seconds ==> USB mode menu. Those easy access USB modes will definitely come in handy. :)
That's the usual anti-script-kiddie trap (just joking) *G* Thx 4 reporting it :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 09, 2013, 01:34:25 am
Repackaging seems to be simpler...  (script tested, resulting file not yet)

and btw.. please somebody be nice to Dave so he removes that braindead filetype-filter!
Quote
You cannot upload that type of file. The only allowed extensions are doc,gif,jpg,pdf,png,txt,zip,tar,c,h,hex,bas,xls,odt,asm,wav,aiff,wma,mp3,flac

Edit: for a Windows version see: http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg369037/#msg369037 (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg369037/#msg369037)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 09, 2013, 01:35:04 am
Taucher,

I agree, a threaded socket in the battery base is a good option. Mike said the same. I wonder why FLIR overlooked such an obvious need when such a suitable location existed ? They don't even offer an optional tripod mount or stand.
I just bought some 1/4" to 3/8" thread adaptors, which I think will glue into a cavity in the battery endcap. This endcap is part of the battery, so can be left off if you need to do a warranty return.
Will be playing over the weekend.
Battery clip probably not the most stable fixing but should be adequate.

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mrflibble on November 09, 2013, 01:35:31 am
Just to be clear ... in menu go to "Camera information". Press right button for 10 seconds. USB mode menu now available.

The USB ID's for the various modes:

Code: [Select]
MSD                  : 09cb:ffff
UVC                  : 09cb:1004
RNDIS                : 09cb:1002
RNDIS and UVC        : 09cb:1005
RNDIS and MSD        : 09cb:1006
UVC and MSD (default): 09cb:1007
RNDIS, UVC and MSD   : 09cb:1005
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 09, 2013, 01:39:34 am

@Thread:
Just as clarification: I ment not modding the battery (flimsy plastic stuff) but to machine a replacement counterweight with overize on the front so there's place to add a thread into the metal part - but I'm not totally sure on the stability of the holding posts inside the grip.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 09, 2013, 01:44:55 am
Another step accomplished - .rcc is extracted  ;D

deRcc attachment is the code used to unpack - repacking should work somehow like that

Wow, the QML is nicely documented, love that there are comments that explain why certain code is added. ;)

..well if all that stuff is interpreted at runtime, no wonder it's so sluggish, but considering the hackability benefits, I can live with legacy code from other models running on a bloated OS..!

Presumably we now know enough to implement image mode toggle on the back button..?

At this rate someone's going to find the HDL for the FPGA hiding in there...
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: scibit on November 09, 2013, 01:50:31 am
>That sucks.
Mine still says "On Hold" :(

I asked after I was onhold for 1 day and was told as a 1st time overseas billing address buyer shipping  to a US addr, they need me to send them a copy of the credit card and a bill showing my card address.  I thought I got the last ex-stock piece at tequipment, but no more I think.  I am in the process of getting from Sam of valuetesters that ship international, but after a day or 2, I am still waiting for a link to pay by paypal.  If it works, they may be the one to go with.   Tequipment is not ready for the international crowd of EEVBLOG.

I send them all that a couple of days ago, but I haven't heard anything since.
I ordered back when they still had 12 of them in stock, but I doubt they reserved one or anything :(
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 09, 2013, 01:51:46 am

@Thread:
Just as clarification: I ment not modding the battery (flimsy plastic stuff) but to machine a replacement counterweight with overize on the front so there's place to add a thread into the metal part - but I'm not totally sure on the stability of the holding posts inside the grip.
Don't have it to hand but ISTR the plate has a slot that the case moulding sits inside all the way round, so as long as any adaptor avoided any major leverage it would probably be OK. It is a fairly complicated shap though - suppose you could make a casting from it. The scres are seltappers though so would need to be careful.

Another option may be a dummy/alternate battery - as it sits quite a way inside it should be stable and you could add an external power-in socket while you're at it.
It should certainly be feasible to 3D print a dummy battery plug for a crude tripod+power mount.
When it's tethered to USB I don't think it pulls enough current to keep it running indefinitley, so you probably need external power for timelapse recording.
 
And at some point we may see cheap Chinese clone batteries appearing, which would be a source for moulded parts.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: equinoxe on November 09, 2013, 01:53:32 am
Addressing Mike's annoyance that several keys are not mapped when using the device: :

In the desktop.qml there is the handling of the buttons.
I guess you could add your functions here..
Quote
There is this eg...
[..]
  // Touch and keyboard handling
    MouseArea {
        anchors.fill: parent
        onPressed: {
            if (!menus.menuOpen)
                longTapTimer.start()
        }

        onReleased: {
            // this is slighly tricky, the longTapTimer opens the menu, quickly followed by
            // the onReleased being called when the user releases the mouse. We have to avoid
            // closing it immediately after opening.
            if (menus.activeMenu === Menus.ZoomPopupMenu)
            {
                // but later, if the user clicks again, we have to close the zoom popup again
                // on single click.
                if (!longTapTimer.running)
                    menus.closeMenu();
            }
            else
               menus.toggleMenu(); // open the main menu
            longTapTimer.stop()
        }
    }

[..]
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 09, 2013, 02:15:43 am

The repackaging script works perfectly ...
Flir logo: gone
Missing Icons: they all show up now (extra images came from the Exx series firmware) :)

I'll do some alpha tests, then release all changes as one package

Note: do not blindly merge/overwrite with Exx-QML files - I did some diffing, the code has relevant differences and will not work out of the box.

Attachment: use only if you know what you're doing
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 09, 2013, 02:25:40 am
A tool is certainly useful - the lens position complicates it as to have a tool that lets you turn while looking at the screen, without your fingers obscuring the view, it will need to be a sort of funnel shape. As the only thing the tool can grab is the curved notches in the lens, I'm pretty sure a plastic 3D print wouldn't have the edge definition - maybe a stereolithoraphed tool but not sure if it would be strong enough.
You probably want the end to be plastic to avoid damage to the lens housing.
I'm exploring some solutions - best I have so far is a cut-down PL259 plug sleeve and a polymorph moulded end.
I think something may be viable with a disc of PCB material and 2mm acrylic rod, but that doesn't solve the taper requirement to make it adjustable without fingers in view. 
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 09, 2013, 02:36:12 am
A tool is certainly useful - the lens position complicates it as to have a tool that lets you turn while looking at the screen, without your fingers obscuring the view, it will need to be a sort of funnel shape. As the only thing the tool can grab is the curved notches in the lens, I'm pretty sure a plastic 3D print wouldn't have the edge definition - maybe a stereolithoraphed tool but not sure if it would be strong enough.
You probably want the end to be plastic to avoid damage to the lens housing.
I'm exploring some solutions - best I have so far is a cut-down PL259 plug sleeve and a polymorph moulded end.
I think something may be viable with a disc of PCB material and 2mm acrylic rod, but that doesn't solve the taper requirement to make it adjustable without fingers in view.
Mike as you tried it already: how many 360° turns (approx.) does the lens need to focus down to lets say 10cm (4")? Just one or two or rather ten?

Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 09, 2013, 03:00:33 am
Hmmm, I have been doing some research on FLIR's past response to hacking by the general public.

It isn't looking good so potential purchasers should think about buying an E4 sooner rather than later.

The FLIR SCOUT PSxx handheld series comes in different versions with a significant price difference associated with more features. One such extra feature is composite video output. Users discovered that there were four gold contacts on the bottom of the unit. Two are the power supply input and the other two turned out to be composite video on all models including those that supposedly did not have the option fitted. Many users built simple contact plates that fitted to the nits base and tapped off the video feed.

http://www.predatormastersforums.com/forums/ubbthreads.php?ubb=showflat&Number=2418562&page=all (http://www.predatormastersforums.com/forums/ubbthreads.php?ubb=showflat&Number=2418562&page=all)

http://www.ar15.com/forums/t_6_18/400168_.html (http://www.ar15.com/forums/t_6_18/400168_.html)

FLIR's response..... they removed the composite video contacts on the lower end models and so forced users t open the unit to hack it internally.

..but they left the feed available internally.

Any way to get 320x240 from an E4 without soldering to it, even via serial console or service mode is a major win - everything else is icing.
The E4 target market is probably somewhat different to nigh-vision so attitude may be different in either direction.
ATAR issues on night vision scopes may also affect policy - I wonder if external video has any affect on export classification.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Taucher on November 09, 2013, 03:01:58 am
Menu mod - Beta 3 - see attachment if you're an advanced user

EDIT: ATTENTION - NOT FOR 2.x or higher firmware - there do exist other solutions for recent cameras!

EDIT: Beta3 added - digital zoom, MSX fine-tuning, condensation (rel. hum) values can be changed
If you want the newest and brightest then you just need Beta3!

EDIT: Beta2 added with patched color palettes (thanks Peter) - see http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg331132/#msg331132 (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg331132/#msg331132)
That patch fixes crashes in Lava and Arctic palettes (an BETA1 issue)
Beta1/2 screenshots: http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg326292/#msg326292 (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg326292/#msg326292)

Notice to MAC users only: Flir Tools seem to ignore your camera if you don't switch back your USB mode after applying the hack.

If you need additional instructions how to install the patch, then take a look here: http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg366426/#msg366426 (http://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg366426/#msg366426)

EDIT: Removed outdated downloads:
* ADDMENU-BETA1.zip (473.5 kB - downloaded 102 times.)
* ADDMENU-BETA2.zip (473.58 kB - downloaded 87 times.)


DOWNLOAD BELOW
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: scibit on November 09, 2013, 03:08:38 am
Just got an update from Tequipment. Estimated Ship Date: 12/04/2013.
So much for ordering it when they still had stock  :-\
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 09, 2013, 03:10:46 am
why don't you cancel and order somewhere else where they have stock?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 09, 2013, 03:23:05 am
Re. caps settings - I tried your last version last night with my standard e8.cfg and didn't notice anything obviously not there - will recheck later.
I assume you just do an 'enable everythng' in the .cfg to make sure.

You made a comment re. issue with advanced measurements & pallettes maybe having issues - one potential clash is fixed temp mode and user-settable palette thresholds, both potentially use the up/down buttons - One would hope that this works with the left/right buttons just selecting between all 4 functions instead of 3 in fixed mode - something worth checking!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 09, 2013, 03:30:04 am
At least with the new UI hacks there now isn't really any reason to ever update firmware on current units - I can't think of anything they could add that would make it really worth the risk.
As regards new units - it's just a case of wait & see. It does seem like the distribution pipeline is pretty short judging by cal dates we've seen, but any software change would go through their internal QA process.
May be interesting to look at file dates  on 1.19.x firmware as that is the latest release seen.


Title: Re: Flir E4 Thermal imaging camera teardown
Post by: scibit on November 09, 2013, 03:34:12 am
why don't you cancel and order somewhere else where they have stock?

That sounds like a good idea. If I can find somewhere that still has stock.
Might have to phone around.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 09, 2013, 03:52:40 am
why don't you cancel and order somewhere else where they have stock?

That sounds like a good idea. If I can find somewhere that still has stock.
Might have to phone around.
You can still order somewhere else where it is on stock. Just wait to cancel the other order until you received your unit. With the current ship date you've been told you have plenty of time. But even Flir-direct who had stock until today is now out of stock for the next 2-3 weeks and as far as I can see, all stock in Germany is also gone by now.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: scibit on November 09, 2013, 03:57:15 am
why don't you cancel and order somewhere else where they have stock?

That sounds like a good idea. If I can find somewhere that still has stock.
Might have to phone around.
You can still order somewhere else where it is on stock. Just wait to cancel the other order until you received your unit. With the current ship date you've been told you have plenty of time.

Just got off the phone with Ivy Tools. They had one in stock that they'd put aside for me, and said if I ordered now they'd ship it first thing on Monday.
Ended up being a little more expensive, but in the end I'd call it a win  :)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: edavid on November 09, 2013, 04:01:23 am
shopflir.com claims to have 2 in stock.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ixfd64 on November 09, 2013, 04:11:59 am
How hard would it be hard to write custom firmware for a thermal camera?
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: Pinkus on November 09, 2013, 04:16:34 am
Ended up being a little more expensive, but in the end I'd call it a win  :)
Good decision!
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: georges80 on November 09, 2013, 05:53:14 am
My unit arrived yesterday afternoon (test equipment depot), ordered Tues.

Played with it for a few minutes in its 'e4' resolution and was underwhelmed. Performed the mikehack and it certainly makes it a tool versus a toy (imho). Resolution of course much improved as well as the overall image quality.

I've ordered a ZnSe lens on ebay, so hopefully in a couple of weeks I'll me able to use it for close up work on small PCB's. Right now at 0.5m it is 'ok' but not particularly great. A monocle is definitely needed for my application.

I haven't tried to fiddle with the built in lens - since I assume it wouldn't allow for close up work even if 'adjusted'. I'm looking to be able to get focus from 3 - 4" range. Am I right in assuming the ZnSe monocle is the right choice?


WRT FLIR E4 sales, yeah, I figure it is hurting their competition a lot more than it is FLIR...

A finally, I'm really really impressed with the hacking ability (and persistence) of a bunch of folk in this thread, kudos to all!

cheers,
george.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ixfd64 on November 09, 2013, 06:01:53 am
Fluke is offering huge rebates on their VT02 and VT04 units as part of their recent promo: http://www.testequity.com/documents/pdf/VT02-VT04-rebate.pdf (http://www.testequity.com/documents/pdf/VT02-VT04-rebate.pdf)

I wonder if this thread had anything to do with it. 8)
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nixxon on November 09, 2013, 06:11:58 am
Just a few quick questions regarding the E4 after mucho hacking success:

Is it possible - with the most recent hack - to manually select Temperature Level in camera?

Is it possible to select - in camera - Temperature Span? And, if so, what is the minimum span? 2.5 degrees C or less is good.

If I didn't already own a Fluke TiR, I would probably buy this E4 thing, solely due to Mike and the Mechanic's hack. I am pretty happy with the TiR's manual focus, level control and -span.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 09, 2013, 06:18:00 am
Post 1000
That is all.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: mikeselectricstuff on November 09, 2013, 06:20:58 am
Just a few quick questions regarding the E4 after mucho hacking success:

Is it possible - with the most recent hack - to manually select Temperature Level in camera?

Is it possible to select - in camera - Temperature Span? And, if so, what is the minimum span? 2.5 degrees C or less is good.
With Taucher's hack, yes, but it's still in beta test.
You can't exactly set span around a centre value, but you can set the high and low ends of the scale seperately, and also together to set the centre while keeping the same span.
From memory minimum span is not as low as 2.5 - don't have it to hand but I think somewhere between 5 and 10
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: zapta on November 09, 2013, 06:29:40 am
Post 1000
That is all.

Some threads are just long, this one is also extremely useful.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: ixfd64 on November 09, 2013, 06:36:05 am
And I actually read each and every one of them. :O
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: aargee on November 09, 2013, 06:42:16 am
It's the velocity of this thread that's quite amazing! Still waiting for the Tequipment order to arrive at the "agent" in the US. Well, I guess it had to go from one side of the US to the other on free shipping.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: nixxon on November 09, 2013, 06:55:06 am
Is the Thermal Sensitivity (or Minimum Detectable Temperature Difference (MDTD)) affected by the M&M hack? If we are talking <0.06°C, like the E6 and E8, it would be pretty impressive.

This is of course of no importance to electronics troubleshooting.

Flir E-series specs source: http://www.flir.com/thermography/americas/us/view/?id=61194&collectionid=830&col=61196 (http://www.flir.com/thermography/americas/us/view/?id=61194&collectionid=830&col=61196) )

Enclosed is a picture of my Yanmar 1GM10 sea water cooled engine as I did the winter conservation procedure in late October.
Title: Re: Flir E4 Thermal imaging camera teardown
Post by: OrBy on November 09, 2013, 07:23:40 am
Add me to the list of E4 buyers due to this thread. Now the question is how many toys do I need