Flir E4 Thermal imaging camera teardown

[KenGaler]

Apologies, my response was unclear and maybe a bit slow. I meant to direct my message at KenGaler

Now that I have it all updated I'll be looking into how it effects the temp readings.  I'll post the results.

Ken

[Relaxe]

Does anyone know how to get the manual temp scale on the menus?

Thanks again

I have hacked my E4, it is 1.2L with firmware 2.11, both resolution and menu hack work perfectly, including the manual temp scale and zoom !
Thank you everyone!

For resolution hack:
I follow the guide ( http://fubar.gr/hacking-the-flir-e4/) and use the script pack from 2lps (https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg921880/#msg921880).   

For menu hack:
I didn't  use the python script. I modify the config.cfc as 2lps  (https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg975993/#msg975993) and replace it manually.

Hello All,

Just successfully hacked my E4 1.2L with firmware 2.11, following difxati instructions above.
Thanks to everyone who made this possible!

[trevwhite]

do you get manual zoom and temperature scale adjustment? When I did mine with firmware 2.3 I do not think I have all the menu options

[Relaxe]

do you get manual zoom and temperature scale adjustment? When I did mine with firmware 2.3 I do not think I have all the menu options

I have the manual temperature scale, but I did not find the zoom.

[KenGaler]

I have the temp scale and zoom but, am I suppose to have a batt level indicator?

[Relaxe]

Small note:
I did not perform the "remove RNDIS" .fif optionnal procedure.
Hence, after taking some nice shots and wanting to transfer them to my boss, I plugged tghe camera's USB to see a network interface.

Problem is, my Windows 10 x64 machine did not acquire an IP address from this interface. I tried to manually set it to 192.168.0.1, to no avail.

I tried on two different machines with the same behaviour. I tought I lost access to the USB port forever! An almost bricked with the camera stuck in non-functionnal RNDIS.
The Win7 x86 machine I used to perform the hack was hastly updated to win10 64x straight after the procedure.
I managed to find a netbook with windows 10 32 bits. It somehow worked like a charm on it. I was then able to perform the "Remove RNDIS" procedure

TL;DR: I think there is an issue with the network driver under windows 10 64 bits.
Using windows 10 32 bits seems to work for the network connectivity.
Maybe it's the reason people recommend against using a x64 windows to perform the hack.

[sailah]

For menu hack:
I didn't  use the python script. I modify the config.cfc as 2lps  (https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg975993/#msg975993) and replace it manually.

Forgive me, I'm a complete NOOB here.  I've read through the thread a bunch.  Seem to have all the files I need.

My camera is a 2.11 as well.  I have copied the 2LPS files to the c:\ location.

Could someone please explain what is meant by the above quote?  I opened the conf.cfg file and can enter my information where the xxxxxxx is.  But this is where the wheels come off.  How do I run that script?  I have used python all of once in my life and that once was today 

Thanks for the help and free lobster if you are near MA and want to do this for me!!

[sailah]

Success!

I set up an old XP computer, however could not get Filezilla to run on it.  I have a Windows 7 x64 machine so I said screw it and attempted on it.

The res hack went smoothly.  The menu hack was successful but had a couple bumps.  I could not get the camera to establish connection to run the FLIRinstallnet.exe procedure to load the 2.3.0 menu.  After 3-4 attempts of hard restarting I finally got connection and installed the menu again.  Worked great and I'm up and running.

Image quality is superb, thanks for the efforts of everyone who participated.  I know as a complete computer noob that I would never have been able to attempt any of this without a step by step guide.  So thank you!

Mine was a 2.11 camera bought from Grainger this week.

[Relaxe]

Forgive me, I'm a complete NOOB here.  I've read through the thread a bunch.  Seem to have all the files I need.

My camera is a 2.11 as well.  I have copied the 2LPS files to the c:\ location.

Could someone please explain what is meant by the above quote?  I opened the conf.cfg file and can enter my information where the xxxxxxx is.  But this is where the wheels come off.  How do I run that script?  I have used python all of once in my life and that once was today 

Thanks for the help and free lobster if you are near MA and want to do this for me!!

You must use cfccfg_V2.py (search the forum to find it)
With it, you can encrypt the conf.cfG you have to a conf.cfC.
When done, BACKUP TO ORIGINAL FILE, and copy your's over the one in FlashFS\system\appcore.d\config.d (trough filezilla)
Shut down the camera, remove/replace battery and voilà!

[peperoca]

Forgive me, I'm a complete NOOB here.  I've read through the thread a bunch.  Seem to have all the files I need.

My camera is a 2.11 as well.  I have copied the 2LPS files to the c:\ location.

Could someone please explain what is meant by the above quote?  I opened the conf.cfg file and can enter my information where the xxxxxxx is.  But this is where the wheels come off.  How do I run that script?  I have used python all of once in my life and that once was today 

Thanks for the help and free lobster if you are near MA and want to do this for me!!

You must use cfccfg_V2.py (search the forum to find it)
With it, you can encrypt the conf.cfG you have to a conf.cfC.
When done, BACKUP TO ORIGINAL FILE, and copy your's over the one in FlashFS\system\appcore.d\config.d (trough filezilla)
Shut down the camera, remove/replace battery and voilà!

I'm not able to run the cfccfg_V2.py It keeps asking for my SUID even though I type it in. Is there someone that could encrypt the file for me, if I the conf.cfg with the camera ID and the CRC03 in it and my SUID?

Thanks in advance.

[Signal32]

Is there someone that could encrypt the file for me, if I the conf.cfg with the camera ID and the CRC03 in it and my SUID?

Upload it somewhere and PM it to me + the info.

[peperoca]

Upload it somewhere and PM it to me + the info.

Thanks Signal32!

I have been messing around again and got the reshack (already had) and the menu for the E5 2.11. However the manual temp scale is still missing, but everything else works including zoom. Did manual CRC03 calculation and ftool encryption. Did not try to use the cfccfgv2.py this time.

I have compared the 2lps conf.cfc with mine, and I have several lines missing in my original file:
.caps.config.ui entry
.caps.config.ui.image entry
.caps.config.ui.image.adjust entry
.caps.config.ui.image.adjust.enabled bool  true
.caps.config.ui.image.adjust.manual bool  true

I did include them on my conf.cfc prior encryption but then it ruined the reshack. Undid it and the reshack was restored.

Do this have to do with the manual temp scale?

I think I'm gonna leave things as they are since the camera has improved a lot since the factory settings.

Best!

[Platonas]

Hello people,
Does this hack (upgrade) work on the Flir E5 or only on E4? 

Thanks.

[Chanc3]

Hello people,
Does this hack (upgrade) work on the Flir E5 or only on E4? 

Thanks.

It should work on the E5 also.

[that1guy]

I did the resolution hack on my E4 (2.3.0) according to the instructions at http://fubar.gr/hacking-the-flir-e4/.  But the image quality got worse after the hack - there's a halo effect of extra grainy pixels on the outter edges of the image:  with shutter closed: 

- notice the grainy pixels around the boundary.

I ran the revert command (python apply.py revert 192.168.0.2), then hard reboot,  but the image is still weird.  I backed up files on the camera via ftp before hack attempt.  So I manually uploaded common_dll.dll and conf.cfc back to the camera.  Image is still weird.

Eeek!  Help please.

ps - I did this hack on a different 2.3.0 camera about a year ago - everything worked perfectly.

[peterflir]

Ok many thanks guys here for providing all information. I have bought a second hand almost unused I3 camera with 6.5.3 firmware. After trying a lot last night it works like the I7.  ( Biggest problem was the CRC and CRLF placing.

[peperoca]

Hello people,
Does this hack (upgrade) work on the Flir E5 or only on E4? 

Thanks.

Hi Platonas. It does work on an E5, I have one.

I could not get the manual temp scale setting, but every other feature works great.

Best,
Pepe

[janekivi]

Hi there!
Ex software is all the same. Only difference is Conf files for everyone. If You get dll cracked it is the
same file for all of them. You can send it to friend too. Now decrypt conf file and replace all stuff
with required lines, at the end is Your serial. Blind XOR apply is not good if something is not in
required place in crypted conf file. Crypt it back and replace. Now this is only for this camera.
If You get small reso but no noise, then something is wrong and it's not accepting conf.

This way this is working for all of them, even for little poor E8...

[mikhail076]

Hi.
Can anybody help me?
My E4 hangs on Flir logo while it powers on. 
Camera is connecting as ASCO disk (FLIR Bootloader USB device) and contains two files error.txt (empty) and typeinfo.txt (contains some serials and MAC address).
Flir tools says «no camera connected» when i try to update firmware.
I tried to scan network for this MAC but unsuccessfully, tried to copy firmware update files to this disk and there is no result.
I have saved original firmware files for this camera but can not put them on.
What could I do with this issue?

[Fraser]

Some background to the fault occurrence would be helpful I think.

Did the camera just suddenly stop working or did it fail after an attempted upgrade ? If it just suddenly failed then you could have a hardware issue that no amount of software manipulation or firmware uploads will repair.

A failure during an attempted upgrade or firmware upload is a different and more hopeful scenario. As there are some very clever people on this forum who may be able to help you recover the OS operation.

Is the camera under warranty ? If so, have it repaired by FLIR as they will do so without issue.

Fraser

[joe-c]

I remind this state a wile ago...
i know no way to fix it yourself 

What did FLIR charge to re-flash your E4 please ? This information may be useful to others who end up with a unrecoverable bricked E4.

Hello,
The Camera is still by FLIR. I hope to receive it in the next 2 weeks.

Hat i have done:
1. Set Camera in RNDIS mode
2. open "FLIRInstallNet.exe" from /bin folder (FLIR Tools)
3. Download old firmware  (flir_ex_pn639_v1.18.7_update_pack.zip) from somewhere in this forum
4. flashing the "Z3comb_v1.18.7.fif"
5. Camera restarts later and was found as new Volume (ASCO 23.9MB)
6. only the FLIR logo was shown and the Asco volume... that's it.
I tried to use the hardware UART with "usbfn RNDIS" but nothing happens.
I copied the files inside the ASCO Volume (see attechment). If I store files there and restart the Camera, the files are disappeared.

I have the theory, that FLIR store some command file there and if the Camera restarts they have additional a working RNDIS mode for reflash.
However, they don't will let us know this...

Is your software going to be available in English please ?

The Software is partly in English (the words are shorter ) but more in German. You can see in Schreenshots.
I could look to make it more Multilanguage... If my kids let me...

[Fraser]

A 'return to FLIR' case then Joe-C.

Remind me, did they charge you for the 'repair' ?

Fraser

[joe-c]

yes, but not directly, i get a invoice over my distributor.
i am not sure, it was maybe around 200 euro.

[Fraser]

A used E4 in new condition sold on ebay UK today for £380. With used camera prices like that it becomes debatable whether returning to FLIR for repair is still economic. Maybe that was just a low price but prices do seem to be dropping.

Fraser

[mikhail076]

Camera restarts later and was found as new Volume (ASCO 23.9MB)
Only the FLIR logo was shown and the Asco volume... that's it.
I tried to use the hardware UART with "usbfn RNDIS" but nothing happens.
I copied the files inside the ASCO Volume (see attechment). If I store files there and restart the Camera, the files are disappeared.

This is exactly what I have.
and it seems no warranty.
Really nobody knows how to access the file system?