Author Topic: Is the TE-M1 a software downgraded TE-Q1 ?  (Read 21352 times)

0 Members and 1 Guest are viewing this topic.

Offline Marvin_324Topic starter

  • Newbie
  • Posts: 5
  • Country: 00
Re: Is the TE-M1 a software downgraded TE-Q1 ?
« Reply #50 on: September 12, 2018, 09:50:38 pm »
As for hidden firmware update in the apk file - i don't think so:
You can go back and forth between old app and new app and the results are the same:
old Android app .... image in corner
new Android app .... image in center

Will do some more test soon.
 

Online mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 13695
  • Country: gb
    • Mike's Electric Stuff
Re: Is the TE-M1 a software downgraded TE-Q1 ?
« Reply #51 on: September 13, 2018, 07:12:28 am »
Could you capture the USB traffic on the two versions to see if there are any obvious differences?
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline mahony

  • Regular Contributor
  • *
  • Posts: 156
  • Country: de
Re: Is the TE-M1 a software downgraded TE-Q1 ?
« Reply #52 on: September 13, 2018, 03:43:40 pm »
@Marvin_324: could you please upload or share link to the current .apk / App download or is it already in the PlayStore?
Regards
Toni
 

Offline Marvin_324Topic starter

  • Newbie
  • Posts: 5
  • Country: 00
Re: Is the TE-M1 a software downgraded TE-Q1 ?
« Reply #53 on: September 20, 2018, 09:29:56 am »
Here you go: https://files.fm/u/dcsvjpcw

old version is in the play store
 

Offline mahony

  • Regular Contributor
  • *
  • Posts: 156
  • Country: de
Re: Is the TE-M1 a software downgraded TE-Q1 ?
« Reply #54 on: September 20, 2018, 12:10:50 pm »
To be honest I almost do not want to say this because it renders my V1 purchase virtually obsolete. I mostly wanted a good, hackable 25Hz+ camera core - the VGA resoultion is/was just a bonus mostly.

I just had a very quick lock at the Java code and from what I have seen it always receives the full 384x296 raw frame from the sensor and just uses only a portion of it - hence it was easy for them to fix the actual used part of the image.

That means using the Zadig Driver and the attached small C# program you might be able to get a full 384x288 image from the M1 camera. Give it a try... if it works the M1 has the potential to be the cheapest QVGA 30Hz imager with very reasonable image quality available at the moment! If I knew this 4 weeks ago I would have bought the M1 instead. ::)

The program requires a Windows PC and .NET 4.5 and the Zadig driver installed for the M1 - the Q1 should work with either the Zadig Driver or the I3 DLL.
 

Offline Fraser

  • Super Contributor
  • ***
  • Posts: 13149
  • Country: gb
Re: Is the TE-M1 a software downgraded TE-Q1 ?
« Reply #55 on: September 20, 2018, 12:28:30 pm »
A very wise fellow forum member once described these Phone Dongle type thermal cameras to me as being similar to SDR receivers. They are 'just' the hardware front end and all the processing of the output is down to the host and its software. As such, these dongles have the potential to be highly configurable and their output a gift to those clever enough to write their own host code 🙂

With the TE series, at least you are working with some decent hardware at the front end  :-+

Fraser
If I have helped you please consider a donation : https://gofund.me/c86b0a2c
 

Offline Vipitis

  • Frequent Contributor
  • **
  • Posts: 867
  • Country: de
  • aspiring thermal photography enthusiast
Re: Is the TE-M1 a software downgraded TE-Q1 ?
« Reply #56 on: September 20, 2018, 12:59:47 pm »
If anyone manages to get a full resolution image out of it, I am going to order one. I wonder if it would be possible to get out images in full resolution through an Android phone as well.

Right now I am trying to find out how to get a 30hz version of the imager and if my phone would work for it.

Far better than the Seek Thermal Pro if this gets to work.
 

Offline bap2703

  • Regular Contributor
  • *
  • Posts: 200
  • Country: io
Re: Is the TE-M1 a software downgraded TE-Q1 ?
« Reply #57 on: September 20, 2018, 01:26:19 pm »
There is this m_fiMVGAPlusSensorWidth = 240;
And that
m_fiQVGAPlusSensorWidth = 384;

Can this be changed ? :D
 

Offline Fraser

  • Super Contributor
  • ***
  • Posts: 13149
  • Country: gb
Re: Is the TE-M1 a software downgraded TE-Q1 ?
« Reply #58 on: September 20, 2018, 01:43:10 pm »
Potential buyers of M versions for upgrade need to take note of what happened with the FLIR E4 when it got upgraded. The OEM will likely act quite quickly to attempt a countermeasure to any upgrade in order to protect their product sales. Sadly the fact that any potential 'hack' will be in software also makes it very vulnerable to countermeasures.

We could be looking at a rerun of the FLIR E4 upgrade story 😄

Fraser
If I have helped you please consider a donation : https://gofund.me/c86b0a2c
 

Offline bap2703

  • Regular Contributor
  • *
  • Posts: 200
  • Country: io
Re: Is the TE-M1 a software downgraded TE-Q1 ?
« Reply #59 on: September 20, 2018, 02:02:04 pm »
There are a few lines selecting between M and Q like this :

Code: [Select]
if (this.mWindowMode == 1) {
...
            this.commData.m_iImageWidth = this.commData.m_fiMVGAPlusSensorWidth;
            this.commData.m_iImageHeight = this.commData.m_fiMVGAPlusActiveHeight;
...
else {
            this.commData.m_iImageWidth = this.commData.m_fiQVGAPlusSensorWidth;
            this.commData.m_iImageHeight = this.commData.m_fiQVGAPlusActiveHeight;
...
}

Some others like
Code: [Select]
        String filename = GetFilePath("/i3cam", "dead", ".bin");
        if (this.mWindowMode == 1) {
            filename = GetFilePath("/i3cam", "dead_M1", ".bin");

Finally that mWindowMode comes from the camera (EZUSB from cypress = camera):
Code: [Select]
        byte[] m_buf = new byte[512];
        int iLen = this.m_EZUSB.Read(m_buf, m_buf.length);
        int[] m_IntBuf = new int[256];
        for (int pos = 0; pos < 256; pos++) {
            m_IntBuf[pos] = (m_buf[pos * 2] & 255) + ((m_buf[(pos * 2) + 1] & 255) << 8);
        }
        this.mWindowMode = m_IntBuf[avcodec.AV_CODEC_ID_BINKVIDEO];
        this.m240ColStart = m_IntBuf[avcodec.AV_CODEC_ID_IFF_ILBM];
        this.m180RowStart = m_IntBuf[avcodec.AV_CODEC_ID_LAGARITH];
 

Offline Vipitis

  • Frequent Contributor
  • **
  • Posts: 867
  • Country: de
  • aspiring thermal photography enthusiast
Re: Is the TE-M1 a software downgraded TE-Q1 ?
« Reply #60 on: September 20, 2018, 04:24:56 pm »
well... you could just add a line and set the variable back to 0 a little bit after and recompile?

now for desktop software, i3 offers different tools and an SDK as well; I wonder if this works similar.
 

Offline mahony

  • Regular Contributor
  • *
  • Posts: 156
  • Country: de
Re: Is the TE-M1 a software downgraded TE-Q1 ?
« Reply #61 on: September 20, 2018, 05:58:23 pm »
Writing software for Android should very well be possible for someone with a descent amount of experience in Java/Android development - so not me ;-)

The issue with the windows and probably the Linux SDK too is that it is written in C/C++ and therefore is way more complex to decompile and make serious use of that code. It is much easier to just extract the important parts/algorithms from the java decompiled code, namely the temperature calculation and calibration stuff and write your own code C#, C++ or whatever language you like. This is what I did in C# (the attached TEViewer) and planning to do in C++ too at some point for use on a Linux system.

It would be much easier to have a M1 here for testing but as my software basically just ignores the flags the Android App reads in and then sets the mWindowMode variable I suppose i might just take it as a Q1 and reads and displays the entire image. I did not check if the calibration data is also for the full 384x288 pixels but there is no good reason why not - all the raw frames are of the same size and so should be the flash data frames. Although there are quite some points that might cause trouble… we will see what Marvin_324 finds out. ;-)
 

Offline borrk

  • Newbie
  • Posts: 4
  • Country: va
Re: Is the TE-M1 a software downgraded TE-Q1 ?
« Reply #62 on: November 03, 2018, 11:33:06 pm »
Setting the variable to 0 doesn't help (or I'm doing it wrong))

I try to understand, what value exactly the
this.mWindowMode = m_IntBuf[avcodec.AV_CODEC_ID_BINKVIDEO]

is expecting from the Q camera?
 

Offline Vipitis

  • Frequent Contributor
  • **
  • Posts: 867
  • Country: de
  • aspiring thermal photography enthusiast
Re: Is the TE-M1 a software downgraded TE-Q1 ?
« Reply #63 on: November 04, 2018, 05:10:42 am »
I have zero clue and for me it's guesswork. My mind tells me that it's theoretically possible, but I am holding back on a purshase until it happens.

So I am just hoping someone with the unit figures it out because I need that slight push to make a purshase decision.
 

Offline borrk

  • Newbie
  • Posts: 4
  • Country: va
Re: Is the TE-M1 a software downgraded TE-Q1 ?
« Reply #64 on: November 04, 2018, 06:37:59 pm »
Well,  try hacking the app and I will act as the tester.

so far I tried removing this code block via smali modification,
        for (int pos = 0; pos < 256; pos++) {
            m_IntBuf[pos] = (m_buf[pos * 2] & 255) + ((m_buf[(pos * 2) + 1] & 255) << 8);
        }
        this.mWindowMode = m_IntBuf[avcodec.AV_CODEC_ID_BINKVIDEO];
        this.m240ColStart = m_IntBuf[avcodec.AV_CODEC_ID_IFF_ILBM];
        this.m180RowStart = m_IntBuf[avcodec.AV_CODEC_ID_LAGARITH];

Only effect was grey, empty live view.

Changing variables
this.commData.m_fiQVGAPlusSensorWidth;
this.commData.m_fiQVGAPlusActiveHeight;
to match ones for QVGA, resulted in a really messed artifact image.
 

Offline mahony

  • Regular Contributor
  • *
  • Posts: 156
  • Country: de
Re: Is the TE-M1 a software downgraded TE-Q1 ?
« Reply #65 on: November 06, 2018, 11:44:46 am »
Did any of you guys with an M1 at hand try to use the windows app attached to post #54 with the M1? (NOTE: requires the Zadig WinUSB driver to be installed for the cam)
Any feedback might definately clarify things here...
 

Offline borrk

  • Newbie
  • Posts: 4
  • Country: va
Re: Is the TE-M1 a software downgraded TE-Q1 ?
« Reply #66 on: November 09, 2018, 08:49:33 pm »
Hi,
(was sourcing correct cable to be able to connect it to a PC)

After testing - no luck - with original i3 driver it cannot even connect, with zadiq one it can connect, but all I get is a white screen.
BTW, your app is reported as virus by few leading AV programs, maybe that's what scared other users.
 

Offline mahony

  • Regular Contributor
  • *
  • Posts: 156
  • Country: de
Re: Is the TE-M1 a software downgraded TE-Q1 ?
« Reply #67 on: November 11, 2018, 06:10:04 pm »
Thanks for the feedback! Interesting that you can connect but seem to get no (valid) images back. No connect with i3 drivers is expected behavior.

Regarding the AV issue - on my dev machine is just the default windows defender which does not complain.
I assume some AV programs may not like it due to the default obfuscation of the exe?!  :-// Sorry for that!

I may put a quick tool together that offers some more options to receive raw data … but not this week I'm afraid.
 

Offline borrk

  • Newbie
  • Posts: 4
  • Country: va
Re: Is the TE-M1 a software downgraded TE-Q1 ?
« Reply #68 on: November 12, 2018, 09:01:38 pm »
No idea why they don't like it (default windows Defender included, had to disable it to even download the zip file and check the exe with virus total.

I don't have direct access to the camera anymore, but if you have some sw to test, I should be able to arrange a test within few days.
 
 

Offline mahony

  • Regular Contributor
  • *
  • Posts: 156
  • Country: de
Re: Is the TE-M1 a software downgraded TE-Q1 ?
« Reply #69 on: November 13, 2018, 07:22:14 pm »
I put together a seriously stripped down C# console app that runs with both my TE cameras (Q1+ and V1). I also attached the source for those that cannot (or don't  want to) download the binary. It seems to required at least .NET framework 4.0 (I usually use 4.5) - 3.5 gave me 1 error I did not want to hunt down. ;)

Run this directly after connecting the TE-M/Q/V1 (with Zadig driver installed for it!) and enter the expected raw image size (M1/Q1: 384x296, V1: 640x482) and if connection is successful it will start grabbing 50 frames from the camera in 1s intervals. The raw bytes will be dumped to disk for further examination.

You may experiment with different data sizes but be warned: the total frame size should be dividable by 512! I.e. I can get data from my Q1 by entering 256x222 as raw size (=222 packets a 512bytes) which happens to be half the real frame size. Even 296x256 (2/3 of the original frame size) and 512x296 (1.5 frames per transfer) works perfectly - you essentially just get the frame data in differently sized chunks if you want to but you receive the full frame in any case! For sizes larger than the actual frame the Q1 returns the full frame plus the rest of the requested size padded with some arbitrary value.

I would expect that 384x296 might be fine to get some data from the M1 but feel free to experiment.


Final edit: If anyone manages to get frame data out of a M1 please upload the raw data of those 50 initial frames.
« Last Edit: November 13, 2018, 07:33:57 pm by mahony »
 

Offline jika

  • Newbie
  • Posts: 1
  • Country: de
Re: Is the TE-M1 a software downgraded TE-Q1 ?
« Reply #70 on: November 14, 2018, 07:56:53 pm »
I have just got my M1, so i had not much time to play with it.. But i got some data with your program :)

I have also captured the usb traffic with usbpcap while playing (receiving 2 single frames and 3 Fpa Temp) with the test program from the Windows API, perhaps it is useful in some way. (t7_TP_M1.pcap)
I also tried to connect in Q1 mode to my M1 camera and receive an single image. (t6_TP_Q1.pcap)

Files are too big, so:
https://ufile.io/fk8z6
 

Offline mahony

  • Regular Contributor
  • *
  • Posts: 156
  • Country: de
Re: Is the TE-M1 a software downgraded TE-Q1 ?
« Reply #71 on: November 14, 2018, 09:01:31 pm »
Thank you very much @jika!

Looks like bad new for all that hoped for a really good and cheap (and fast 30Hz) QVGA imager.
Unfortunately the raw data seems to just give dead pixel, correction and image data for a 240x180 sub-image of the QVGA sensor.


Attached images are two of the raw frames converted to 16bit image data.

The first image raw000.png shows the very first frame containing the dead pixel data. As you can see there is as 240x180 region of 'valid' data embedded in a 394x296 raw image.

In contrast the raw030_384.png image shows one of the first image frames. Here you can clearly see (at least with the 240 pixel wide raw030_240.png version) that the image frames only give 240x180x2 consecutive bytes of image data followed by a large portion of invalid (65535 value) data.

Maybe there is still hope - I am not yet sure if the correction gain/offset factors are only available for the 240x180 range or for the full 384x296 frame. AND there is some method in the decompiled java source:
Code: [Select]
//INIT of device Q/M
    public void InitDeviceMode() {
        int recvNum = 0;
        byte[] tempData = new byte[512];
        tempData[0] = (byte) -5;
        tempData[1] = (byte) -6;
        tempData[2] = (byte) 0;
        tempData[3] = (byte) -93;
        tempData[60] = (byte) 1;
        tempData[61] = (byte) 0;
        tempData[508] = (byte) 0;
        tempData[509] = (byte) -93;
        tempData[510] = (byte) -53;
        tempData[511] = (byte) -54;
//write single package and read one 512byte answer
        while (recvNum != tempData.length) {
            recvNum = this.m_EZUSB.Write(tempData, tempData.length);
            delay(30);
        }
        delay(100);
        byte[] m_buf = new byte[512];
        int iLen = this.m_EZUSB.Read(m_buf, m_buf.length);
        int[] m_IntBuf = new int[256];
        for (int pos = 0; pos < 256; pos++) { //convert to cons. bytes to int16/32
            m_IntBuf[pos] = (m_buf[pos * 2] & 255) + ((m_buf[(pos * 2) + 1] & 255) << 8);
        }
//this is where windowMode and col/row start are set initially!!
        this.mWindowMode = m_IntBuf[135]; //avcodec.AV_CODEC_ID_BINKVIDEO=135?!
        this.m240ColStart = m_IntBuf[136]; //avcodec.AV_CODEC_ID_IFF_ILBM=136/137?!
        this.m180RowStart = m_IntBuf[146]; //avcodec.AV_CODEC_ID_LAGARITH=146?!
    }

This actually send some init commands to the Q1/M1 and set the windowing mode and image offsets in the app.
I think someone with basic .NET skills (or any other programming language), the source code from my last post, a M1 at hand and some time might be able to get some intersting findings here ... I am lacking mostly time and the M1 camera at the moment. ;)
 

Offline Vipitis

  • Frequent Contributor
  • **
  • Posts: 867
  • Country: de
  • aspiring thermal photography enthusiast
Re: Is the TE-M1 a software downgraded TE-Q1 ?
« Reply #72 on: November 14, 2018, 10:43:47 pm »
the 000 frame seems to be windowed off center and we know from the previous post that different android apps can request a different window position. Still open questions. I won't buy an M1 this year myself but let's see where this is going.
 

Offline mahony

  • Regular Contributor
  • *
  • Posts: 156
  • Country: de
Re: Is the TE-M1 a software downgraded TE-Q1 ?
« Reply #73 on: November 15, 2018, 07:32:12 am »
@Vipitis: Yepp, right - that is why I mentioned the initialization code. I guess somewhere in there it is possible to move the windowing region and maybe even switch to full Frame mode.
 

Offline mahony

  • Regular Contributor
  • *
  • Posts: 156
  • Country: de
Re: Is the TE-M1 a software downgraded TE-Q1 ?
« Reply #74 on: November 28, 2018, 01:06:33 pm »
Seems like the M-1 in 30Hz version is currently on sale from the known Austrian distributer for 399€:
https://www.ebay.de/itm/Warmebildkamera-Infrarotbild-TE-M1-240x180-Pixel-30Hz-Warmebild-Thermal-Expert/283121690439?hash=item41eb5e2747
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf