Author Topic: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax  (Read 5614 times)

0 Members and 1 Guest are viewing this topic.

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
UPDATE: The hack has been released! For more information, downloads, and full tutorial, go to https://spirit.re/projects/flir_hack.php
This hack works for all Ex, Exx, and Txxx cameras.

Video tutorial(referencing the page):






Original post:

I recently managed to acquire a used FLIR T440bx for a good price, but when it came to me I was slightly surprised.
FLIR advertise this model as having support for UltraMax - their proprietary super-resolution algorithm.

When I looked at the manual for enabling and using this feature, the steps detailed within it did not match my unit at all - the menus were missing, the structure was completely different.
Now, knowing that the camera is an early unit, from 2012(serial number 62100xxx, part number 62101-0701), I sort of expected having to update the firmware, and so I connected it to my PC, installed the drivers, and sure enough, when I checked in FLIR Tools+, it said that I needed a new firmware for the unit.
However, when I clicked update, not only did it not start a remote update process(which is expected with the Txxx series units), it gave me a prompt saying that my firmware version is 1.4.1(which doesn't exist!). I thought, alright, maybe it's just a bug.
But then when I tried to updating to the version it linked me to - 1.38.21, via the "eFLIRInstall.exe" and "E3Comb_v.1.38.23.fif" files placed on the SD card, the camera crashed halfway through the update with "E11 Bad Checksum on Transferred OS", and only managed to start(in the old firmware) after I pulled the battery out.

Before doing this, I did grab a full dump of the file system via RNDIS - looks like the firmware is one of the earliest versions, with the "conf.cfg" file in plain text(see below).

Code: [Select]
#
# appcore_config
#
# Generated at 2012-03-27 17:54:04
#
.caps entry
.caps.config entry
.caps.config.name text "app T440bx"
.caps.config.revision text "1.0"
.caps.config.direction entry
.caps.config.direction.sensorAccel entry
.caps.config.direction.sensorAccel.enabled bool true
.caps.config.direction.compass entry
.caps.config.direction.compass.enabled bool true
.caps.config.image entry
.caps.config.image.framegrab entry
.caps.config.image.framegrab.fusion entry
.caps.config.image.framegrab.fusion.enabled bool true
.caps.config.image.framegrab.fusion.pip entry
.caps.config.image.framegrab.fusion.pip.enabled bool true
.caps.config.image.framegrab.fusion.hcf entry
.caps.config.image.framegrab.fusion.hcf.enabled bool true
.caps.config.image.sensor entry
.caps.config.image.sensor.enabled bool true
.caps.config.image.services entry
.caps.config.image.services.store entry
.caps.config.image.services.store.enabled bool true
.caps.config.image.services.store.radiometric entry
.caps.config.image.services.store.radiometric.enabled bool true
.caps.config.image.services.store.incompatible entry
.caps.config.image.services.store.incompatible.enabled bool false
.caps.config.image.services.store.incompatible.level int32 0
.caps.config.image.settings entry
.caps.config.image.settings.enabled bool true
.caps.config.image.settings.downsample bool false
.caps.config.image.settings.resIR int32 320
.caps.config.image.sysimg entry
.caps.config.image.sysimg.alarms entry
.caps.config.image.sysimg.alarms.enabled bool true
.caps.config.image.sysimg.alarms.measfunc entry
.caps.config.image.sysimg.alarms.measfunc.enabled bool true
.caps.config.image.sysimg.alarms.measfunc.maxCount int32 4
.caps.config.image.sysimg.alarms.humidity entry
.caps.config.image.sysimg.alarms.humidity.enabled bool true
.caps.config.image.sysimg.alarms.humidity.maxCount int32 1
.caps.config.image.sysimg.alarms.insulation entry
.caps.config.image.sysimg.alarms.insulation.enabled bool true
.caps.config.image.sysimg.alarms.insulation.maxCount int32 1
.caps.config.image.sysimg.irMarkers entry
.caps.config.image.sysimg.irMarkers.enabled bool false
.caps.config.image.sysimg.irMarkers.spot entry
.caps.config.image.sysimg.irMarkers.spot.enabled bool false
.caps.config.image.sysimg.irMarkers.spot.maxCount int32 0
.caps.config.image.sysimg.irMarkers.arrow entry
.caps.config.image.sysimg.irMarkers.arrow.enabled bool true
.caps.config.image.sysimg.irMarkers.arrow.maxCount int32 4
.caps.config.image.sysimg.irMarkers.box entry
.caps.config.image.sysimg.irMarkers.box.enabled bool false
.caps.config.image.sysimg.irMarkers.box.maxCount int32 0
.caps.config.image.sysimg.measureFuncs entry
.caps.config.image.sysimg.measureFuncs.enabled bool true
.caps.config.image.sysimg.measureFuncs.diff entry
.caps.config.image.sysimg.measureFuncs.diff.enabled bool true
.caps.config.image.sysimg.measureFuncs.diff.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.diff.calcMask int32 65526
.caps.config.image.sysimg.measureFuncs.isotherm entry
.caps.config.image.sysimg.measureFuncs.isotherm.enabled bool true
.caps.config.image.sysimg.measureFuncs.isotherm.calcMask int32 20
.caps.config.image.sysimg.measureFuncs.isotherm.dual bool false
.caps.config.image.sysimg.measureFuncs.isotherm.fixScale bool false
.caps.config.image.sysimg.measureFuncs.isotherm.interval bool true
.caps.config.image.sysimg.measureFuncs.isotherm.invInterval bool false
.caps.config.image.sysimg.measureFuncs.isotherm.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.mbox entry
.caps.config.image.sysimg.measureFuncs.mbox.enabled bool true
.caps.config.image.sysimg.measureFuncs.mbox.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mbox.maxCount int32 5
.caps.config.image.sysimg.measureFuncs.mcircle entry
.caps.config.image.sysimg.measureFuncs.mcircle.enabled bool false
.caps.config.image.sysimg.measureFuncs.mcircle.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mcircle.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.mline entry
.caps.config.image.sysimg.measureFuncs.mline.enabled bool true
.caps.config.image.sysimg.measureFuncs.mline.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mline.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.reftemp entry
.caps.config.image.sysimg.measureFuncs.reftemp.enabled bool true
.caps.config.image.sysimg.measureFuncs.reftemp.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.reftemp.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.script entry
.caps.config.image.sysimg.measureFuncs.script.enabled false
.caps.config.image.sysimg.measureFuncs.script.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.spot entry
.caps.config.image.sysimg.measureFuncs.spot.enabled bool true
.caps.config.image.sysimg.measureFuncs.spot.calcMask int32 514
.caps.config.image.sysimg.measureFuncs.spot.maxCount int32 5
.caps.config.image.sysimg.visualMarkers entry
.caps.config.image.sysimg.visualMarkers.enabled bool false
.caps.config.image.sysimg.visualMarkers.spot entry
.caps.config.image.sysimg.visualMarkers.spot.enabled bool false
.caps.config.image.sysimg.visualMarkers.spot.maxCount int32 0
.caps.config.image.sysimg.visualMarkers.arrow entry
.caps.config.image.sysimg.visualMarkers.arrow.enabled bool false
.caps.config.image.sysimg.visualMarkers.arrow.maxCount int32 0
.caps.config.image.sysimg.visualMarkers.box entry
.caps.config.image.sysimg.visualMarkers.box.enabled bool false
.caps.config.image.sysimg.visualMarkers.box.maxCount int32 0
.caps.config.image.sysimg.gps entry
.caps.config.image.sysimg.gps.enabled bool false
.caps.config.image.targetNoise entry
.caps.config.image.targetNoise.enabled bool false
.caps.config.image.targetNoise.targetNoiseMk int32 0
.caps.config.image.zoom entry
.caps.config.image.zoom.enabled bool true
.caps.config.image.zoom.maxFactor double 8
# ID 62100eev
# CRC01 33vb10ge

For once the noise generator is not enabled...

There doesn't appear to be much to hack in terms of features, but UltraMax is definitely interesting - 4x the effective resolution on >9Hz cameras, for free, based only in camera firmware.

Here is the official FLIR link for the 1.38.21 firmware:
http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_t420-t440_pn62101_02_v1.38.23_update_pack.zip

Does anybody have any ideas on what is going on here?
« Last Edit: June 18, 2018, 04:29:38 pm by Spirit532 »
 

Offline Chanc3

  • Frequent Contributor
  • **
  • Posts: 394
  • Country: gb
Alas the older models (pre 2014) don't have the actual physical hardware to support the UltraMax feature (nor MSX).

Not sure what is going on with your firmware however... That is a mystery!
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
Alas the older models (pre 2014) don't have the actual physical hardware to support the UltraMax feature (nor MSX).

My T440bx supports all three - isotherms, picture in picture, and MSX, so I'm assuming UltraMax is possible too.
My model is also listed as supporting UltraMax - but this firmware version is a mystery.
« Last Edit: February 03, 2018, 09:51:57 am by Spirit532 »
 

Offline Chanc3

  • Frequent Contributor
  • **
  • Posts: 394
  • Country: gb
Alas the older models (pre 2014) don't have the actual physical hardware to support the UltraMax feature (nor MSX).

My T440bx supports all three - isotherms, picture in picture, and MSX, so I'm assuming UltraMax is possible too.
My model is also listed as supported - but this firmware version is a mystery.
Interesting! It wasn't really until 2014 that MSX was released. Have you looked at the gui.cfg file?
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
Have you looked at the gui.cfg file?

There is no such file in my dump.

However, there is .system/ui.d/config.d/conf.cfg, and that file contains an interesting line:
Code: [Select]
.caps.config.save.fastShoot bool false
Could this be the UltraMax feature?
 

Offline Chanc3

  • Frequent Contributor
  • **
  • Posts: 394
  • Country: gb
I've seen that on our T620, but alas it doesn't seem to do anything!
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
I've seen that on our T620, but alas it doesn't seem to do anything!

Can confirm, just checked. Neither "fastshoot" nor "panorama" do anything, they're the only two disabled options in ui/conf.cfg
The CRC01 process works, plain and simple. No need to touch the dlls.

Going to touch a few other files now, to see if something changes.
 

Online Fraser

  • Super Contributor
  • ***
  • Posts: 7663
  • Country: gb
In situations like this I would normally contact FLIR support requesting clarification on the firmware version that I have, and can upgrade to. You may have a problem on this front due to your location however.

FLIR do not list their previous firmware versions so it does not mean much if you cannot find it mentioned anywhere.

It is definitely not a good idea to load an incorrect firmware version in the hope that it will work. That path can lead to much sorrow if the camera is not smart enough to abort the operation before it is completed. This is especially so with your camera having an 'unusual' firmware version that is not available as a download. You have tried the 'official' firmware version for your camera part number so it really is a case of stick with what you have, or contact FLIR for help getting the correct firmware. The downloaded firmware could even be corrupt on their servers.

You may also wish to investigate the cameras Service Menu for the option to enable the higher temperature range.

Fraser

« Last Edit: February 03, 2018, 10:38:28 am by Fraser »
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
In situations like this I would normally contact FLIR support requesting clarification on the firmware version that I have, and can upgrade to. You may have a problem on this front due to your location however.
Already done. I doubt they'll help anyway, but I did open up a ticket and register my camera.

FLIR do not list their previous firmware versions so it does not mean much if you cannot find it mentioned anywhere.
There is a leaky XML file on their site(that opens automatically when you click "update") that lists all the versions if you look around. Mine is definitely not listed there >_>

You may also wish to investigate the cameras Service Menu for the option to enable the higher temperature range.
The "bx" has the range enabled and calibrated by default :)



As for the hack - this version of the firmware is completely insecure.
Short guide for software version 1.4.1 only(untested on others):

1) Back up the filesystem(configs especially) via RNDIS.
2) Edit the .cfg however you want, enabling all features still works. Be sure to increase the max counts too :)
3) Remove the line containing "# CRC01" from the file, so that the line containing "# ID" is followed by a newline.
4) Run "crc01.exe conf.cfg", copy the "# CRC01" line it gives you back into the file after "# ID". Make sure there's a newline after it.
5) Reupload the file back to the camera. Make sure to overwrite.
6) Power the camera off, then pull the battery out(important).
7) Put the battery back in, turn it on, enjoy the hack.



Now we need more insight into the firmware updates - this version barely has any hackable features(the most useful is a measurement circle, lol).
GPS is not available despite what the config says, or so it appears - I see no info related to it in the UI, but I'll dig further.
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
Another oddity.
The web service menu is there, but entirely protected by a password(not blank), and it is not "IRCAM", "3vlig", or "1235". These guesses were under the user "flir", which seems to be universal across their entire portfolio.
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
Here's an addition for the hack:
Since the preview JPEG quality is so low(usually 85%), I made a user preset to increase it to 100%


To do this I'm using an unlisted preset - "$preset_estimate_max_load", which is not present in the files.
Inside that I created a "user.rsc" with the following code:
Code: [Select]
#
# Generated at 2011-01-26 11:13:54
#
.image entry
.image.services entry
.image.services.store entry
.image.services.store.quality int32 100
# CRC01 12ad0621


Should be pretty self-explanatory.
Attached is a file for lazy hacking - just extract the contents of the folder into /system/ on your camera(it should ask to overwrite 1 file), cold reboot(by removing battery).

If done correctly, and your camera is set to English, you should see this in your preset menu:


It has to be run every time you change modes.
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
Alas the older models (pre 2014) don't have the actual physical hardware to support the UltraMax feature (nor MSX).

Just received a reply from FLIR - my T440bx is an older 62101-0701, which does not support UltraMax.
The 62103-xxxx and 62104-xxxx support UltraMax, and it's a five hundred dollar option to purchase.

They still have no idea on the software version though, waiting for more info.

I guess the original topic of this thread is going to change a little - DIY UltraMax!
I have an idea on to do this on any 30/60Hz capable camera, will update soon if it works out.
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
Update soon, as promised!  ;D

A custom hack menu is likely possible.(see edit)

Managed to build a full WinCE application including the full SDK. Lots of possibilities from here on out.
Still working out the application window focus kinks. Right now moving or interacting with the menu immediately brings it to the foreground where it's impossible to manipulate.



EDIT: A custom menu hack is possible, including keyboard hooks, windows, and UI elements.
I don't see a reason as to why this isn't reproducible on the Ex(!!!) and Exx series cameras as well.
More info as soon as I get it to be stable in the foreground.
« Last Edit: February 07, 2018, 04:19:26 pm by Spirit532 »
 

Offline David C

  • Contributor
  • Posts: 45
  • Country: ca
Just to make sure I'm following, you're looking into a possible user "add-on" for the Ultramax feature that could work for both Ex and Exx series ? Meaning an E8+ could possibly feature the Ultramax 4x resolution upscaling in a near future ?
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 2778
  • Country: ca
I remember seeing somewhere that superresolution end image is not produced on the camera, all the camera does is captures a stack of images, the combined image is then generated by Flir software outside of the camera. Can't remember where i saw it and for what camera model.
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
Just to make sure I'm following, you're looking into a possible user "add-on" for the Ultramax feature that could work for both Ex and Exx series ? Meaning an E8+ could possibly feature the Ultramax 4x resolution upscaling in a near future ?

Correct.
Also, as seen in the previous post, a huge variety of different hacks become possible once a stable, non-glitchy custom window is available(right now I'm battling with uicore.exe stealing app focus away).

I remember seeing somewhere that superresolution end image is not produced on the camera, all the camera does is captures a stack of images, the combined image is then generated by Flir software outside of the camera. Can't remember where i saw it and for what camera model.

Correct.
An UltraMax image is a standard FLIR radiometric image that has 16 lossless JPEGs(JPEG-LS) images embedded in it as a sequence, in addition to one standard 16-bit radiometric raw.
I've managed to separate them out, but I have not yet figured out a way to construct an UltraMax image due to the JPEG-LS filesize being non-constant(so a simple binary replacement won't work).
 

Offline David C

  • Contributor
  • Posts: 45
  • Country: ca
Back from my college days in graphic design, we had a third-party Photoshop plugin called Fractal made by OnOne. Fractal is an upsizing algorithm that creates new pixels to bridge the gaps and back in 2010 it was pretty amazing how good it worked, even with small resolution files. Good enough to the point where you could turn a web image into a printable one. I figured such algorithm was used for the Ultramax and other similar upscaling of thermal imager ? However you mention that in addition of upscaling a single jpeg, it overlays 16 other jpeg to fill in the radio metric data of the created pixels ?
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
UltraMax(and Testo's SuperResolution, same thing basically) rely on the tiny hand movements between frames to basically put the sensor pixels themselves "between" the gaps - effectively increasing the pixel density.
The idea is to not only get a higher resolution, "fake" upscaled image - but actual sub-pixel radiometric values.

It's a mix of supersampling and deconvolution, just lots math.
 

Offline David C

  • Contributor
  • Posts: 45
  • Country: ca
You said it could work on 30hz and above imagers, but what about the 9hz Ex series ? Perhaps the results would be less dense ?
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
The goal is the same - to capture 16 slightly different images.
I'm assuming you'll just have to have very steady hands for ~2 seconds :)
 

Offline David C

  • Contributor
  • Posts: 45
  • Country: ca
That works for me. I'm guessing it's not gonna be effective on moving objects and targets with temp variations above 9hz ?
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
Definitely not. This is very much a "still image" thing, even on 30/60Hz devices.
 

Offline David C

  • Contributor
  • Posts: 45
  • Country: ca
I'd be interested in doing some amateur photography with my E8+, so 4x upscaling would serve the purpose nicely, despite the low end output of the Ex imager. Let me know if you need some funding in your research !
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
I might need help with testing on other hardware(namely the Ex and Ex0), but I am far from done right now.
I've got the keyboard hook working though, all of the controls register as separate buttons! :)
Still fighting the GUI.
 

Offline David C

  • Contributor
  • Posts: 45
  • Country: ca
I am not wizz enough in the coding department, however I can navigate my way trough file logs and html type of stuff, as well as poke around folders if I know I'm not gonna mess anything up on the camera itself. I think Bud with his E4+ wifi will be the man to do the Ex testing, but feel free to ask what you need and I'll do what I can to make it happen.
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
I'll post an update here when I have something more interesting to show. I'm really going for a custom GUI called up by a key combination or double click - the rest is pretty simple.
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
The Ex and Exx camera custom menu is a go!
Here is what I have accomplished at the time of writing this post:
  • Persistence - the hack can be loaded automatically at boot time(not done yet), and it retains all the internal information at runtime, regardless how many times you close the window.
  • UI elements - I have full control over the WinCE default UI, including messages and elements.
  • Global keyboard/input hook - I can trigger app functionality from anywhere within the system, on any physical button or specific action(long press, quick tap, etc).
  • A persistent configuration file - for storing custom settings and whatnot.
  • Write access to FLIR's internal registry(which is not related to WinCE) - for enabling/disabling camera functionality, and basically anything you can do with "rset", and then some(sequencing).
  • A persistent configuration file - for storing the menu's settings across reboots.
  • The ability to record a short(5-10s, due to RAM limits), completely raw, radiometric image sequence to the SD card or internal flash.

What I don't have at the moment:
  • Reading FLIR's internal registry - WinCE does not support pipes, and the only way to read the registry without reverse-engineering FLIR code is via "rls.exe", which outputs to either console or file(see next point).
  • File read functionality - this may be a "bad code" issue, but CreateFileW simply does not want to open any files anywhere on the system except the flash root. This isn't an awful issue, but it's something to keep in mind.
  • A way to convert the radiometric image sequence into an UltraMax-compatible image, either on-camera or off-camera. I don't think it makes sense to put all the code on-camera(though possible), but I will likely need help with actually creating UltraMax-compatible images. A temporary workaround is to manually do SuperResolution using something like ImageJ, ImageMagick, or Photoshop.

I have made a short video to demonstrate the hack functioning on the camera.
Please note that while I am launching this hack via telnet, the end result should be just a few file replacements(like with the regular E4 hack, but without CRCs), and a single telnet command to install the hack, making it persist across reboots without any user intervention.

In this particular case, the hack was configured to open the menu on a 2-second press of the joystick.



Let me know if there are any specific features you'd like to see implemented.
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
Another small update.

  • Added full keyboard support(for the Ex series), no touch interface required. The settings now stay on the camera as a plaintext ".ini" file.
  • Added persistency. App now loads at boot time, no user intervention required.

« Last Edit: February 09, 2018, 02:02:58 pm by Spirit532 »
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
I've written a small key mapping app to determine the keyboard layout on FLIR Txxx/Ex/Exx series cameras. It should be compatible with any ARMV4I device running Windows CE 5.0 and higher, but I assume no responsibility for anything that might happen when you run it.

If you would like the hack application to run on your camera model, please use this tool on your camera and record which keycode the buttons represent.



A short guide on how to do this:
  • Upload keymapper.exe into the /system directory via FTP.
  • Connect to the camera via telnet, using the same IP address you use for FTP.
  • Run "keymapper" from the terminal window.
  • Press every button, write the corresponding vkCode down. Preferably, overlay it on a photo of your device for reference.
  • When done, restart the device, or kill the app from another terminal with "ps -k keymapper".

Download here:
https://spirit.re/projects/files/wince_key_mapper/keymapper.exe

More info here.
« Last Edit: February 10, 2018, 05:11:46 pm by Spirit532 »
 

Offline David C

  • Contributor
  • Posts: 45
  • Country: ca
Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
« Reply #29 on: February 10, 2018, 05:17:52 pm »
Cool work, I'm excited to see what comes next !
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
« Reply #30 on: February 16, 2018, 07:34:19 am »
I believe I have enough features implemented in this app to begin testing compatibility with other devices(Ex and Exx cameras).

If anyone is interested and has a device that they would like to test on, please reply in this thread and I'll PM you with further info.
For now the testing will be done in private, but I do plan on releasing this publicly, for free.



 

Offline David C

  • Contributor
  • Posts: 45
  • Country: ca
Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
« Reply #31 on: February 16, 2018, 09:23:44 am »
Interested with E4 wifi
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
« Reply #32 on: February 16, 2018, 02:40:09 pm »
PM sent! Still looking for more people though.

Also added another feature - an automatic focus stacker/racking tool that creates a 60-frame sequence as it pulls through the entire focus range of the camera(Txxx only, because this needs autofocus).


Now comes the hard part - creating something to read and export the ".seq" files created by the camera, do stacking(or superresolution), and then convert them into standard radiometric JPEGs or something like that.
 

Offline tomas123

  • Frequent Contributor
  • **
  • Posts: 832
  • Country: de
Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
« Reply #33 on: February 16, 2018, 09:39:22 pm »
Now comes the hard part - creating something to read and export the ".seq" files created by the camera, do stacking(or superresolution), and then convert them into standard radiometric JPEGs or something like that.

I posted last 5 years something in this forum about .seq, stacking, ultramax and creating FLIR radiometric JPEGs from 16 bit tiff files.
I can help you, to find this bread crumbs ;-)
« Last Edit: February 16, 2018, 09:44:31 pm by tomas123 »
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
« Reply #34 on: February 17, 2018, 01:10:52 am »
I've read your posts during the creation of this hack, they've been quite helpful. PM sent about the other stuff.
 

Offline David C

  • Contributor
  • Posts: 45
  • Country: ca
Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
« Reply #35 on: February 20, 2018, 01:27:52 pm »
Here's the tree file from my E4 wifi with advanced package upgrade. I blacked out the serial number and SUID with XXX's.
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
« Reply #36 on: February 24, 2018, 07:18:49 am »
Small update: The hack is now compatible with the Ex-series cameras, thanks to David C.

If anyone has an Exx-series camera and would like to help test the hack, please PM me with your Skype username or other preferred method of realtime contact.

I will be releasing the hack publicly and will start accepting feature requests once the Exx version is fully functional.
 

Offline David C

  • Contributor
  • Posts: 45
  • Country: ca
Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
« Reply #37 on: February 27, 2018, 01:54:15 pm »
Spirit's work is wonderful, it would be great if someone with an Exx camera could join in. The hack really maximize the camera potential.
 

Offline Chanc3

  • Frequent Contributor
  • **
  • Posts: 394
  • Country: gb
Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
« Reply #38 on: February 27, 2018, 06:24:18 pm »
I have an Exx, P6xx, A6xx and T6xx camera available, that I can try and see if u can get this on. Obviously, they are units in service currently, so would need to make sure a) free for testing b) I have permission to test on.
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
« Reply #39 on: February 27, 2018, 09:22:11 pm »
Another E4 Wifi test successful, this time by the user "Myself"

I have an Exx, P6xx, A6xx and T6xx camera available, that I can try and see if u can get this on. Obviously, they are units in service currently, so would need to make sure a) free for testing b) I have permission to test on.

PM Sent!
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
Another update.
The hack has been tested successfully to be fully compatible with FLIR T4xx, Ex Wifi, and Exx cameras, independent of firmware versions.

It will be released as soon as I have a full tutorial and user guide written up, to make sure it's simple to set up.
 
The following users thanked this post: Sparky, zucca

Offline Sparky

  • Frequent Contributor
  • **
  • Posts: 364
  • Country: us
Hello Spirit532

Amazing accomplishment here and cool to see your in-progress videos!  I have just purchased Flir E4 WiFi and will get in a few days.  It looks like you already completed the testing to ensure compatibility with this camera, but if you need another test data point just PM me :)

I notice your work here supports many camera models, but I am wondering in-relation to Flir E4 WiFi, how does this approach compare to the alternative of Bud detailed here.  I guess I cannot run both...so I am curious of the differences.  Could you summarize?

In the meantime I will wait for my camera to arrive! :D
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
You can run both, I've ensured (almost) complete compatibility with Bud's hack. It's meant to go on top of Bud's hack on cameras where it exists(Ex and Exx), to extend functionality to that which cannot be done with static UI edits.
The hack is almost ready to run on all three series, I'm just a bit busy at the moment so I don't have time to write up a use/installation guide, without which the hack is somewhat pointless as it needs persistence(over reboots).
 
The following users thanked this post: Sparky

Offline Sparky

  • Frequent Contributor
  • **
  • Posts: 364
  • Country: us
You can run both, I've ensured (almost) complete compatibility with Bud's hack. It's meant to go on top of Bud's hack on cameras where it exists(Ex and Exx), to extend functionality to that which cannot be done with static UI edits.
The hack is almost ready to run on all three series, I'm just a bit busy at the moment so I don't have time to write up a use/installation guide, without which the hack is somewhat pointless as it needs persistence(over reboots).

Wow! I didn't expect that it was possible to run both!  Amazing that this is an "add on" pack to Bud's work!  Will be great to read a little summary of the additions added by your work.  Hopefully you can include in your write-up when you get a chance.

Cheers!
Sparky
 

Offline zucca

  • Supporter
  • ****
  • Posts: 1690
  • Country: it
  • EE Meid in Itali
Let me know if you need someone to test a E30 (now E60+)

SN 490214xx
PN 49001-1801
FW 2.23.14
Model E30_B 1.1

If don't need it, I will just sit back and wait for the official release.

Many thanks in advance for your hard work.

Can't know what you don't love. St. Augustine
Can't love what you don't know. Zucca
 

Offline zucca

  • Supporter
  • ****
  • Posts: 1690
  • Country: it
  • EE Meid in Itali
« Last Edit: April 07, 2018, 07:33:49 am by zucca »
Can't know what you don't love. St. Augustine
Can't love what you don't know. Zucca
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
My app is ready to run, it's just difficult to set up and doesn't have many features(UltraMax is nowhere to be seen still, aside from 16-image capture).

As for VNC - yes, it's possible. You're going to get a happy WinCE image that is about as useful as you can expect a completely blank WinCE install without a desktop to be. With very angry authoritative graphics that will override your display even when you don't want them to.
You can run Doom on them as well, just drop in the additional graphics libraries. I got it to run, but couldn't get it to load the game WAD and couldn't be bothered to recompile the entirety of a Doom CE port to fix file system issues ;D
Most native WinCE games and apps will work on these cameras, you can definitely have a lot of fun doing some things.
 

Offline kaz911

  • Frequent Contributor
  • **
  • Posts: 789
  • Country: gb
Hi Spirit532,

I have a "virgin" E50bx Mk1 I can try it on. Any idea if you are close to being ready? :)

/k
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
Hi Spirit532,

I have a "virgin" E50bx Mk1 I can try it on. Any idea if you are close to being ready? :)

/k

You'll want to hack it to E60bx+, my app doesn't do that. It only expands upon the existing hack functionality.
As for readiness, probably soon. Overloaded with work and real life right now.
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
Big update: The hack has been released! For more information, downloads, and full tutorial, go to https://spirit.re/projects/flir_hack.php

Video tutorial(referencing the page):


Yes, I know there's a typo in the video.
 

Offline Vipitis

  • Frequent Contributor
  • **
  • Posts: 351
  • Country: de
  • aspiring thermal photography enthusiast
Great work. I hope the project continues. The best offer for a Txx series I ever found was a T420 for 5000€ + tax. And I can't justify. But I was wondering.
Could you mess with exposure time? That would make astronomy possible.
You wrote about using grid party rendering and superresolution. Would that be similar to the ThermalCamera+ app or something else?
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
No, these sensors don't have any low level control - all that is done in the FPGA.
I'm not sure what grid party rendering is, but superresolution is increasing the actual radiometric resolution by 4x(so 320x240 turns into 640x480) by means of supersampling and then deconvolution. I haven't implemented that yet, as I'm not that good with code.

As for the offer - this hack works on all Ex/Exx cameras as well, including the E4-8.
 

Offline eKretz

  • Frequent Contributor
  • **
  • Posts: 581
Awesome job! Thanks for the effort. So the UltraMax (assuming this is what you're meaning when you say superresolution) is working or not working? I will try this out tomorrow on my E40.
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
At the moment, the hack is only capable of outputting a burst of 16 images to the specified folder. There is no post-processing software that would allow you to create final superresolution images yet.
 

Offline eKretz

  • Frequent Contributor
  • **
  • Posts: 581
Gotcha. I wonder if there's a way to see how the Tools+ software is doing it for the cameras that are capable and tricking it into working for the others.
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
I explained that a bit in my article - take a closer look.
The images my hack takes are directly compatible with the UltraMax JPEGs (even)higher end cameras generate, but the formats are different.
 

Offline eKretz

  • Frequent Contributor
  • **
  • Posts: 581
Got it. Looks promising, and there is a way to do super-resolution with Photoshop with those 16 images.

On another note, I just finished attempting to do the hack, and it isn't working for me on my "E60+ upgraded" E40. Holding the "Back/Menu"  button and pressing the down arrow and releasing results in...nothing at all. I was wondering about the applaunch.dat append though - should that be "# Start hack.launcher" like you have it in the sample? or "# Start Hack.exe" like would seem to be correct?
 

Offline eKretz

  • Frequent Contributor
  • **
  • Posts: 581
Hmm. Decided to try the other method with presets but there's a problem there as well. Your install instructions say for the second method to add the $preset_estimate_max_load folder into /FlashFS/system/profile.d folder. There isn't one on my cam. Presets aren't even normally there in my camera menu unless I enable them in the UI config file - and then the menu entry is just empty. I did try enabling the presets option in the config file and re-running the CRC01 for the correct CRC but the "Back/Menu" plus down arrow combo still does nothing. I am running the 2.23.14 firmware.
« Last Edit: June 19, 2018, 07:31:05 pm by eKretz »
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
Ah, that's right, my bad. It should be "hack", not launcher. Fixed. The "# Start hack." is a comment.
I've uploaded the fix to the site as well.

As for $preset_estimate_max_load - please read the instructions carefully, or watch the video again.
You have to replace an existing preset in the case that adding a preset doesn't work. Also, if your camera is CRC01, you should be able to use applaunch, since it isn't signed.

To check whether the hack is running, you can connect to the camera via telnet and run "ps". "hack.exe" should be in the process list.
« Last Edit: June 19, 2018, 07:41:59 pm by Spirit532 »
 

Offline eKretz

  • Frequent Contributor
  • **
  • Posts: 581
In the case of $preset... you misunderstand - there IS no profile.d in my camera.

In the case of the "hack" vs. "launcher" issue - I just tried fixing that and although it changed things, still not working.  The camera went through normal boot-up except a black screen appeared rather than (or maybe right after) the normal blue one with Flir welcome to infrared blah blah. The progress bar did its thing and the normal infrared camera screen came up and is displaying image and temp etc. .However, the regular menu buttons aren't working at all. I can't bring up any menu. Also tried the "Back/Menu" plus down arrow and when I do that the screen just goes blank of all text and temp info. If I then hit the back button again, the spot, temp and temp scale come back but still can't open the menu. Only way out is a hard power down with 10 second power button press. Just reverted to original applaunch.dat and eveything is working fine again,but of course no hack.
« Last Edit: June 19, 2018, 08:11:58 pm by eKretz »
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
In that case, try placing this launcher.exe next to hack.exe and replacing "hack" with "launcher" in applaunch.dat
https://i.spirit.re/cPvpz.zip
 

Offline eKretz

  • Frequent Contributor
  • **
  • Posts: 581
AARGH! Still not there, but closer. OK, now I'm getting the normal boot screen all the way through to the camera coming on. The menu buttons are now working correctly. I can now open the hack menu with the "Menu/Back" button + down arrow combo. I can scroll and select options with OK button. I can back out of the menu with the "Back/Menu" button. But, When I get back out of the menu with the Super-resolution function enabled, pushing the "Up" arrow does nothing. No activity light on the memory card and no images saved to the ImageSequences folder. I even tried holding the "Menu/Back" button and pressing the "Up" arrow, and that goes "Beep, Beep" but no memory card activity light and no images in the ImageSequences folder. I also noticed at least one of the options isn't there, like the "FLIR Logo" checkbox - not sure if that's intentional though.
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
You have to hold the back button while activating the functions. Otherwise it interferes with other menus.
 

Offline eKretz

  • Frequent Contributor
  • **
  • Posts: 581
Like I said, tried that too. Still no dice. All I get is a couple of beeps and no photos in the ImageSequences folder. And I double-checked that the slashes were the correct way and that the filename matches. Here's the contents of the hack.ini - is all of this correct? What's with the FLIR logo option missing in the hack menu? That only for certain models?

[hackOptions]
disable_nuc = false
record_sequence = false
flir_logo = true
max_jpeg_quality = true
record_stack = false
save_path = \StorageCard\DCIM\ImageSequences
programmable_msx = true
defaultZoomLevel = 1
[buttonDefinitions]
joybutton = 13
backbutton = 112
joyup = 38
joydown = 40
joyleft = 37
joyright = 39

Also, I noticed that sometimes when I go into the hack menu, it disappears except for the bottom white line with the URL. If I then push the up or down arrow keys, each option that is highlighted as I scroll through will come back and stay there, but the header never comes back.  The "Back/Menu" + Right/Left arrow combo does work for the zoom option, but MSX alignment just seems to zoom the visual/digital camera when in PIP mode (My cam is the older version without MSX except for in FLIR Tools).
« Last Edit: June 19, 2018, 09:22:44 pm by eKretz »
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
That's odd - both "record_stack" and "record_sequence" are set to false, but beeps are happening. Are you sure it's enabled? Try turning off and on again, see if that outputs a .seq. You want to record a sequence(superrres).
The FLIR logo option should be there on all models - I'll check once I have a bit more time.
As for the menu disappearing - the visuals should disappear before the menu opens, because that causes interference. It should still function, just a rendering glitch.
 

Offline eKretz

  • Frequent Contributor
  • **
  • Posts: 581
That's just the default .ini. Just wanted to make sure there were no errors there. The camera only beeps when the option for superresolution is toggled on - I tried it both ways. Getting beeps but no pictures with the option toggled on; no beeps and no pictures with the option toggled off. I have also tried power cycling multiple times with no result. One time the power button stopped working and had to do a hard power down, then everything was back to normal on restart. The option for the FLIR logo has never been in the menu on any of the varied attempts.
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
It could be that it isn't liking the path. Try putting it somewhere not on the SD card, but on camera flash.
 

Offline eKretz

  • Frequent Contributor
  • **
  • Posts: 581
Good idea, will try that next. My battery is just about toast so I'll try changing the save directory to flash later after it recharges and report back.
 

Offline eKretz

  • Frequent Contributor
  • **
  • Posts: 581
OK, nope that doesn't work. I tried adding the ImageSequences folder in a couple different places and no dice. Tried in flash and the new folder seems to get instantly erased on reboot - even tried several different folders. Tried changing the save directory to the default "Dir A" folder on the storage card, no deal there either. No matter which way I tried, always the same result - two beeps and no photo sequence saved. Not sure why the new folder isn't persistent in flash memory.
« Last Edit: June 20, 2018, 07:31:18 am by eKretz »
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
There are file system protections, so it can be normal - however, photos not saving to the SD card is really odd, because in all of my tests they worked.
 

Offline eKretz

  • Frequent Contributor
  • **
  • Posts: 581
Out of curiosity, did you try all the versions of E40? From what I understand there were a few different hardware versions. Also, could firmware version make a difference?
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
No, I wasn't able to get every version of every camera :P
It's odd though. You should have write privileges. Try storing directly into DCIM, a folder that already exists. Also try with trailing backslash and without.
 

Offline Nicosrap

  • Newbie
  • Posts: 3
  • Country: cl
Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
« Reply #72 on: October 05, 2018, 05:31:47 am »
http://subirimagen.me/uploads/20181004142641.25

Dear as I can update or install new firmware.
I'm from Chile, try to log in via FTP but the password goes wrong
 

Offline chili_red

  • Contributor
  • Posts: 38
  • Country: us
Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
« Reply #73 on: October 14, 2018, 02:20:49 am »
I recently acquired a B300, 45306-1600X1, SW version 9.4.5, Camera revision 01.
Any possibility your hack will work in that?
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
« Reply #74 on: October 23, 2018, 09:43:06 am »
Any possibility your hack will work in that?

Nothing is stopping you from trying, it's non-destructive - but be aware that you need a reliable backup in case you get stuck on boot.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf