Therm App unlock 25HZ

[iampm]

Good news: 8.7 hz Therm App has already been unlocked to 25HZ by some teams.
Bad news: They charge about 300 dollars for this service.

[encryptededdy]

Wow, nice. I came across some chinese forums discussing this but I wasn't aware it ended up being successful.

Makes sense though that the hardware is identical - the ULIS microbolometer itself doesn't come in separate 8.7 / 25Hz parts, so it must be done in firmware on the ThermApp.

[nishul]

Very interesting! could you provide more information about the 'teams'?

I found this link posted on the 'nachi.org' - http://www.ulis-ir.com/index.php?infrared-detector=pico384p-037. It says the thermal image sensor used in Therm-app camera is capable of doing 50Hz 

[iampm]

As far as I know, they did it by tearing down a genuine Therm APP Hz model, did some research and accordingly modified the firmware of 8.7hz model (may requre tearing down, I guess) .

Sorry there are no names for the "teams", they just use Tencent Group and of course no details are revealed since they want to make money from it.

[Bill W]

As Israel aren't in the Wassenaar Arrangement this will be a bit different to the usual export control requirements encountered with TICs. 
However still embarrassing for ThermApp to have been cracked if it is as simple as swapping over some code.

Bill

www.fire-tics.co.uk

[Motero]

This is very interesting, someone has tried?
I do not understand the procedure of unlocked, if I wanted to try it , any advice for me?
Thanks and regards

[iampm]

This is very interesting, someone has tried?
I do not understand the procedure of unlocked, if I wanted to try it , any advice for me?
Thanks and regards

It seems that you need a 25HZ model first. 

I find some videos, not sure if you can watch them:
http://v.youku.com/v_show/id_XMTU5MjgxODYwOA==.html?from=s1.8-1-1.2
http://v.youku.com/v_show/id_XMTU5MjgxNTk2OA==.html?from=s1.8-1-1.2
http://v.youku.com/v_show/id_XMTU5MjgxOTQyNA==.html?from=s1.8-1-1.2

[cnxunuo]

i have paid 2000 rmb to the team who crack it.

successfully upgraded to 25hz

this is how it works:

they have a genuine 25hz one, read out the EPCS4N fpga config flash,

flash other device with the same S/N code rom.

then, they send me the android folder, so that first time it connect to my phone,
 the app dont need to go online to download the factory calibration bin file, and use the calibration file for the device that 25hz rom came from.


========

now i only have a logic analyzer,
 i sniff out the epcs4n's traffic (3ch),
but dont know how to encapsulate the raw logic file to flashable altera file.......

[maex]

What does the ThermApp with the old folder contains?

I have read my EPCS4N with an external programmer as M25P40. My serial have I found at 0x70000 as 4 byte hex, after this 0xEF 0xBE 0xAD 0xDE.

0xAD 0xDE = 0xDEAD = dead?

So I can change my serial to something else, only the app cannot find calibration data on the server .

[bitera]

Yes, I can upgrade to 25hz Therm App.
But, this is a fee service.
Other, 3D IR can also be achieved.

----------------- New message -----------------

Now unlock 25hz thermapp already have a better way to optimize the image effect beyond the original 25hz device, and for the old drive also has a very good performance.

This method not only needs to update the firmware, but also needs to collect data for image correction and provide supporting software, this is the charge service.

In addition, we can provide free optimization of the SDK to facilitate you to write applications to support optimal, fully compatible with the SDK and the official version.

There is a need for please contact me: e:399327322@qq.com.

[Davidli]

Haha?I got you guys. after you update the fresh rate to 25Hz, you may need biger Lens. we provide 33MM 60MM lens for Therm app with lower price.

[Davidli]

Attached 60MM lens picture.

[bingo600]

Some of the last posts belongs in buy/sell

/Bingo

[PrinzDaniel]

I´m interessted in the ThermApp 25Hz Upgrade.

Can somebody write me a pm who can help me?

Greets Daniel

[tomas123]

IMHO it's a copy of the 25Hz firmware

[Davidli]

any of them tried hacking the Q1? it be funny if that and the therm app share same firmware.

are you sure that?

[Jeroen3]

I have read my EPCS4N with an external programmer as M25P40. My serial have I found at 0x70000 as 4 byte hex, after this 0xEF 0xBE 0xAD 0xDE.

0xDEADBEEF in little endian. Typical joke value. Is this what they change?

[Bruno28]

Has anyone found a way to upgrade for free? If someone has done this and paid, I'm sure they can share the folder with us?

[bowhunter-57]

Very interesting post,I'd be up for an upgrade on my 8.7 to 25HZ.

[jeffreythe00]

^would also be interested and may even chip in a few bucks

[Davidli]

Lens for Therm app  with lower price.

[Bruno28]

Lens for Therm app  with lower price.

What are the prices?

[Davidli]

what size do you need?

[frenky]

All of them.

[bowhunter-57]

Post a price on all of them,thanks

[mahony]

And if available also for ThermalExpert versions!

[servoner]

Hello! Please PM to me with price for all of them lens. Many thanks!

Shipping from China?

[bitera]

Now unlock 25hz thermapp already have a better way to optimize the image effect beyond the original 25hz device, and for the old drive also has a very good performance.

This method not only needs to update the firmware, but also needs to collect data for image correction and provide supporting software, this is the charge service.

In addition, we can provide free optimization of the SDK to facilitate you to write applications to support optimal, fully compatible with the SDK and the official version.

There is a need for please contact me: e:399327322@qq.com.

[Fraser]

This is what I love about these 'simple' thermal camera dongles. Like SDR technology, you have a data collection head and the rest is software limited only by the capabilities of the programmer. Of course the overall performance will always be constrained by the capabilities of the data collection hardware. Thermal cameras are now so much more in the Digital domain rather than analogue. DSP and good various algorithms can do much to improve the images and capabilities that are presented to the user.

I still do not like the phone dongle format, but it does lend itself to clever software improvements to improve the user experience. I am pleased to see such development being undertaken for the FLIR ONE G2, Therm-App and Thermal Expert. The Therm-App improvements appear a little more advanced in their nature though as the data collection head  hardware is being refined.
One of the expensive elements of thermal camera production is the time it takes to comprehensively calibrate the system for the unique thermal array. At the cheaper end of the market such calibration is cut down to the minimum possible. With the right tools, the performance of a cheap thermal sensor system may be improved via better (more comprehensive) calibration tables and more attention to pixel bias voltages etc. Offering such a 'tuning' service is not a minor task or without risk as if you damage a customers camera in the process you have to replace it at your own cost. I applaud the team who are continuing to refine the Therm-App upgrades that they can offer.

Fraser

[Ben321]

Good news: 8.7 hz Therm App has already been unlocked to 25HZ by some teams.
Bad news: They charge about 300 dollars for this service.

Really bad news, the base model of the ThermApp hardware still costs over $1000.

[Fraser]

Sadly time costs money and those who bought the original 25Hz camera as a source of the hack data source need to recover their investment.

Fraser

[ThermoDude]

Actually the Therm-App is on sale for $940 and Hz for 1500 .Both ways. I wouldn’t recommend the hack. I looked into in on this group:
https://www.flickr.com/groups/therm-app-users/discuss/72157681592072955/
 and got negative feedback on the results. Plus your warrantee is void.

[Fraser]

An interesting first hand report on the upgrade. Thanks

[Ben321]

Actually the Therm-App is on sale for $940 and Hz for 1500 .Both ways. I wouldn’t recommend the hack. I looked into in on this group:
https://www.flickr.com/groups/therm-app-users/discuss/72157681592072955/
 and got negative feedback on the results. Plus your warrantee is void.

Or just buy a ThermApp Hz for twice the price. You wouldn't need to waste your time trying to hack it. Still obviously more than I'd be willing to pay for, even with the increased framerate to justify the cost, but those who really want one and have the money should just buy the ThermApp Hz, which is the full framerate version. As for me, I'm just going to buy a Seek Compact Pro, which only costs $499.

[frenky]

$499 too much based on photos seen...

Sent from my LG-D855 using Tapatalk

[Fraser]

Ben321,

Well done for making a decision on which thermal camera will suit your needs. At least with the SEEK Pro you will have the resolution that you desire and the SDK that you need to write your own applications if desired. SEEK has yet to produce a good low noise camera but image processing can help. Do not expect too much from the SEEK camera and you will be happy with it.

The SEEK camera should keep you busy and entertained for a long time to come.

Fraser

[Jinhua]

I have to say is to unlock the 25hz device can get better than the official 25hz effect of the image calibration effect.
After May 2017, the new method was calibrated with great results and free updates to previously upgraded equipment.

[ThermoDude]

Hz is old new I heard that  Opgal now has the Therm-App Pro available for pre-orders. Double the resolution.

[Davidli]

who want bigger lens, send me email davidlx2005@gmail.com

[bidikman]

what size do you need?

hello do you have optics to sell I would be interested thank you

[bidikman]

hello do you have optics to sell I would be interested thank you

[RBsonic]

Any news about unlock?

[Ultrapurple]

Perhaps I can bring some light back to this otherwise zombie thread.

Changing a 9Hz ThermApp to 25Hz is indeed possible. As some have surmised, it involves removing and reflashing a memory device on the ThermApp camera PCB. Before you ask, no I don't have access to the code or any more details of what actually gets done. However I can confirm that once the camera is re-calibrated, picture quality is very good and does indeed give 25Hz frame rate (dependent on the host phone's processing horsepower of course).

As another poster noted earlier, there is a discussion about the update here. 

There has been speculation about whether the modification is legal. Obviously this depends on your country's laws and international treaty obligations, but I think it's probably not legal in quite a lot of jurisdictions. Furthermore, the laws are generally the same ones that make it tricky to sell nuclear weapons to despots so you may risk substantial penalties.

This thread seemed to disintegrate into a discussion on the prices for third-party lenses and at least one poster has been banned; I don't know whether this was related. I do know that there are several lens options for the ThermApp and similar cameras available from a number of places but, as they're all precision manufactured using expensive substances (germanium) you're not likely to find a 100mm lens for $100 (unless it has been stolen...)

If you are looking for a cut price lens then I suggest you keep your eyes open on eBay and/or search the various other online sales sites like Alibaba. Equally, there is a For Sale / Wanted section of EEVblog where you may find something. 

[RBsonic]

Is it illegal to have 25Hz thermal camera or is it illegal change hardware and firmware of device, which I bought?

Have somebody contact information to guys, which can make unlock (you can send me PM )?

[Ultrapurple]

Legality of a 25Hz camera depends on where you are. In most parts of Western Europe, for example, having a 25Hz or faster camera is OK. The question of whether it's OK to have an upgraded camera is the tricky one: even if the 'same' model is available in both low and high frame rates.

As far as I know you can (for example) export a <9Hz camera 320x240 from the USA to, say, England, with little-to-no paperwork. But the same camera hardware, loaded with 25/30Hz firmware, cannot be exported so freely and, at best, requires export paperwork and probably a certification by the end-user that they won't sell it to anyone Uncle Sam disapproves of. And if you buy the 9Hz camera, export it from the USA and then install 25/30Hz firmware, Uncle Sam is unlikely to be pleased.

(Similar limitations are in place with other countries; I merely use USA / England / Uncle Sam as convenient references).

For a ThermApp camera it's probably the government of Israel who might get upset, as Opgal is based in that country. That said, the sensor is made in France and its manufacturer (Ulis) may have contractual arrangements or legal obligations in place that means the French government would take an interest. It all has the potential to become quite complicated quite quickly.

As far as I can see the safest thing to do is to buy only a camera that's intended for use in your country - and, particularly if it's a fast frame rate device - don't try taking it on your vacation to DPRK.

[Ultrapurple]

The best source of what you can and can't do with a ThermApp camera is probably to get in touch with Opgal (ThermApp). Their contact details are readily available on their website. But I suspect they'll simply say you shouldn't modify their cameras because that's what the international treaties say. I certainly wouldn't expect them to give much in the way of help to adapt a camera.

[RBsonic]

Why must  it be illegal? On Ebay or amazon in my land you can easy buy 9Hz or 25Hz version without any export paperwork or certification. In this case I think it must not be a problem to unlock 9Hz to 25Hz.

[Max Planck]

The best source of what you can and can't do with a ThermApp camera is probably to get in touch with Opgal (ThermApp).

I don't think so. Companies/manufacturers are known for claiming different things. Those claims are often.... just claims.
Unless talking about military equipment, thermographic cameras are - generally speaking - dual use goods. Thus, as I see a German flag, EU regulations 2015/2420 of 12 October 2015 amending Council Regulation (EC) No 428/2009 setting up a Community regime for the control of exports, transfer, brokering and transit of dual use items (with any further amandments) will apply, plus all the legal rules set in the country RBsonic is living in.
The fact of staying at 9 Hz or going above will make the difference. From the regulations above:

Note 3: 6A003.b.4.b. does not control imaging cameras having any of the following:
a. A maximum frame rate equal to or less than 9 Hz;
b. Having all of the following:
1. Having a minimum horizontal or vertical 'Instantaneous-Field-of-View (IFOV)' of at least 10 mrad/pixel (milliradians/pixel);
2. Incorporating a fixed focal-length lens that is not designed to be removed;
3. Not incorporating a 'direct view' display, and
4. Having any of the following:
a. No facility to obtain a viewable image of the detected field-of-view, or
b. The camera is designed for a single kind of application and designed not to be user modified;
or
c. The camera is specially designed for installation into a civilian passenger land vehicle and
having all of the following:
1. The placement and configuration of the camera within the vehicle are solely to assist the
driver in the safe operation of the vehicle;
2. Is only operable when installed in any of the following:
a. The civilian passenger land vehicle for which it was intended and the vehicle weighs less than 4,500 kg (gross vehicle weight); or
b. A specially designed, authorized maintenance test facility; and
3. Incorporates an active mechanism that forces the camera not to function when it is removed from the vehicle for which it was intended.

Etc.

Max

[Fraser]

If I may comment on upgrading frame rate......

On this forum, those of us who have been involved with high frame rate thermal cameras have always tried to enlighten others on the topic of dual use technology and why the <9fps limitation was introduced. It is there to make the movement of this regulated technology easier for both manufacturers and users. Once you make or own a thermal camera that invokes the full dual use technology regulations applicable to high frame rate thermal imaging devices, you should comply with those regulations. I say should, because many users do not. Hence why eBay has a lot of high frame rate kit for sale !

I have made it a personal rule to never publicise anything on this forum that would help someone break the law or defeat equipment controls that exist for good reason. I was pleased to see that the 25fps upgrade was a “chargeable” service where a camera was sent for modification. This is very different to placing an upgrade to frame rate on a public forum, such as releasing a piece of software or code to circumvent the frame rate restriction. Dave does not need the hassle of certain parties getting upset over his forum containing information intended to breach the frame rate restriction. The restriction exists for a good reason. If anyone wants a high frame rate version, just go through the paperwork process to buy the high frame rate model or get it upgraded, but please do not ask people to post a ‘frame rate hack’ on a public forum. That could end badly for us all.

And yes I know we can buy high frame rate thermal cameras on eBay..... I have purchased many including the FLIR SC4000 ..... and that is a heavily controlled camera. I am not daft enough to export it out of the UK though !

Fraser

[Max Planck]

I am not daft enough to export it out of the UK though !
Fraser

Even if all the necessary paperwork/procedures could be followed 

By the way, IIRC, in some countries just keeping the goods within the territory is not enough. Just selling to a foreign national is considered a breach of procedures.

Max

[RBsonic]

What about a history with flir e4???
Is it legal?
There are many posts and topics about this thema.

[Fraser]

The E4 upgrade was resolution increase, not frame rate increase. The two are very different. One is corporate marketing related and the other is Dual Use technology Regulations. It was notable that none on this forum discussed increased frame rate modifications to the E4 

Fraser

[RBsonic]

I don't understand, why I can buy 25Hz thermal kamera (from ebay, from amazon, from china  and it is absolute legal), but I am not allowed to unlock Thetm-App 9Hz to 25Hz (which I can buy without any problem too).

[IwuzBornanerd]

By the way, IIRC, in some countries just keeping the goods within the territory is not enough. Just selling to a foreign national is considered a breach of procedures.

Max

As in the USA, where the laws consider an export to have occurred when material or information is transferred to a foreign person, even if the foreign person is standing on US soil.  I have seen mention of this even in Reuters news articles on ordinary commerce-- whenever a tourist in the US buys something it is considered an export.  But I have no idea how the economists guesstimate the associated numbers.

I don't understand, why I can buy 25Hz thermal kamera (from ebay, from amazon, from china  and it is absolute legal), but I am not allowed to unlock Thetm-App 9Hz to 25Hz (which I can buy without any problem too).

I don't think the problem is with you modifying your own camera.  The problem is that your government and others don't want you to tell everyone else how to do it.  That is what the export laws prohibit.  If you post instructions or software on this forum then people everywhere (terrorists, et. al.) can read it and the next thing you know somebody your government does not want to have such a good camera has one, and your government blames you!  The person who has the hacked camera is not the one who gets punished (unless he gets caught doing something evil with the help of the camera), you get punished because you violated the export rules, even if nothing bad happened as a result.

[RBsonic]

I don't think the problem is with you modifying your own camera.  The problem is that your government and others don't want you to tell everyone else how to do it.  That is what the export laws prohibit.

O.K. That's mean I can legally unlock my thermal camera, but I'm not allowed to say or write how I did it.

What about if I sell unlocked camera to somebody who lives in EU or USA? Is it legal to sell  my unlocked personal thermal camera?

[agiorgitis]

Just some funny moments....!


Terrorist buys Thermapp with 9Hz and hacks it to 30Hz = illegal, huge discussion in forums.

Terrorist pays a bit more and buys the 25Hz out of the box version = he can legally use it to kill people.

People in USA: if I have a modified thermal camera, CIA/FBI/MIB will find out in the airport/train/car/house. Everyone is watching me, they know. Maybe that's why the grocery guy was looking at me suspiciously this morning.

Terrorist: oh no, it's illegal to buy/export a 30Hz version from USA. We'll ship it from EU or China, nevermind. Please also mark it as gift to avoid any taxes.

Guy in airport during scan, in Europe: "hi, in my suitcase I have a thermal camera software upgraded to 30Hz..."
Airport employee: "yes ok, next please...."
Guys: "no listen! There's a hack where you can...."
Airport employee: "NEEEXT...!"

Terrorist: we have $50M and we'll buy some weapons from our friendly weapon supplier.
"Hi, we'll need some grenades, a tank, some missiles with nuclear warheads, a tanker full of drugs, some Russian airplanes, and a 30Hz thermal camera"
Seller: "I have everything apart from.... a 30Hz thermal camera?! Man, this is illegal! I don't sell such things! Would you like some anti-tank RPGs with thermal tracking, with your order?"
Terrorist: "no worries, we'll buy one from ebay"

[Vipitis]

This may all sound like we are overly careful. But the rules are in place for a reason. If you lookup what violations hot punished, it's larger scale.
Yet if you follow OSINT on Twitter about Israel/Lebanon, you can see the implications in the field. An alleged Israeli drone was spotted and taken down in Lebanon, apparently to spy on some news organization or to show how far Israel can reach. Implying that they could do it again with explosives on board.
Some images of the drone surfaced and it was hacked together from commercial parts including something that looked like a camera core behind a black 'metal sheet'. It's hard to tell from the images, but some said that was a LWIR window. Others said it's nIR transparent mirror with illumination behind it.

If wouldn't be a concern if it didn't happen.

[Fraser]

People should not focus on terrorism as the only reason for dual use technology restrictions.

Think DPRK and Iran and you would be nearer the mark.

Fraser

[Ultrapurple]

@Vipitis - interesting, though I'm pretty sure the military forces of Israel (as with most industrialised nations) have sufficiently well developed drone technology available to them that they wouldn't have to "hack something together" from commercial bits and pieces unless someone somewhere was trying to make a point.

[Fraser]

@Ultrapurple,

It is a well known tactic to use commercial ‘off the shelf’ parts in a sacrificial intelligence gathering platform that may fall into ‘enemy hands’. The opposite end of the spectrum is the super high tech military drone technology that not only tries to evade attack and downing, but also employs sophisticated data encryption and protection to hamper reverse engineering/reuse by the enemy.

https://www.ynetnews.com/articles/0,7340,L-5611643,00.html

Fraser

[Vipitis]

Here was the story I had in my memory: https://twitter.com/WithinSyriaBlog/status/1166029171992223745
Let's not get into politics, but it's allegedly Israel, no claims. sUAVs also have a limited range.

there is enough places that shouldn't have access to this technology for military use. And we already had issues for some of the excluded notices in the quoted treaty. Somebody couldn't bring a vehicle based thermal camera for night driving into Egypt.

[Ultrapurple]

I suspect I was very lucky to get in (and out!) of Egypt with my (<9Hz) thermal camera when I was there on vacation a few years ago.

 

I'm not sure I'd do it again.

(Also, it transpires, I had no idea then but one of the medications I'm prescribed by my doctor is a big no-no in Egypt; I cheerfully left packets of the stuff lying around hotel rooms etc in much the same way I'd do with aspirins, little knowing it was legally the equivalent of leaving large bags of cocaine or heroin on the bedside table! It was quite scary when I found that out, much later, when someone was jailed for several years for taking in a similar amount for their local friend's back problems )

[Bill W]

What about if I sell unlocked camera to somebody who lives in EU or USA? Is it legal to sell  my unlocked personal thermal camera?

>9Hz cameras (whether DIY unlocked or born that way) can circulate freely inside the EU as long as they have the appropriate form of words in the manual / letter / invoice.  Look up the correct words as they do change, but something like 'This needs a license if exported outside the EU'.

>9Hz to the US needs an export license from your countries' export control office.  This could be a fairly trivial exercise to invoke an existing generic license, or could be a catch-22 nightmare.

Bill

[bap2703]

Just had a laugh reading this: https://rongland.co.uk/blogs/news/blog-2

As a foreigner even looking through a generation 3 device is not allowed.

Could be used for some nice pranks   

[RBsonic]

Can you explane what  difference between generation 2 and 3?

[Max Planck]

GaAs photocathode (in gen. 3 IITs).

Max

[RBsonic]

So I can understand, generation 3 is not thermal cameras. It is night vision devices, which work with low light. So it is not our case.

[bap2703]

Yes, it's about "night vision device" where one should understand "visible or almost amplification device".
But on the legal matters it's a very similar topic.

[Dai]

If I may comment on upgrading frame rate...

...And yes I know we can buy high frame rate thermal cameras on eBay..... I have purchased many including the FLIR SC4000 ..... and that is a heavily controlled camera. I am not daft enough to export it out of the UK though !

Fraser

A quick question about these R+D cameras, such as that lovely SC4000... Are there any requirements to keep these cameras under lock and key when not in use, such as with a firearm? Apart from some common sense as to keeping such an expensive tool safe, what implications would there be if such a camera was stolen, due to not being locked away and ended up in the wrong hands? Some serious tracking and guidance could be done with 420Hz

[Bill W]

A quick question about these R+D cameras, such as that lovely SC4000... Are there any requirements to keep these cameras under lock and key when not in use, such as with a firearm? Apart from some common sense as to keeping such an expensive tool safe, what implications would there be if such a camera was stolen, due to not being locked away and ended up in the wrong hands? Some serious tracking and guidance could be done with 420Hz

There is no blanket requirement, unless part of the purchase process.  However any theft of a dual use item becomes an 'unauthorised transfer' so the victim would be expected to supply details.  If nothing else the item appearing in resale would be more likely to be traced back.

E2V had a list of stolen cameras (ie nicked from fire engines) as probably would all other manufacturers.  At the end of the Argus3 / Raytheon BST era when licenses were tightened up a lot, the core involved would also have been reported back to Raytheon / BIS in the USA.

Bill