Flir E4 Thermal imaging camera teardown

[georges80]

Ok, we'll see if 12mm is too big

I have a cone inside mine to allow the lens to 'see' more when adjusting. Yeah, the finger grip area is what I was planning to add if the tool keys correctly - figure I'll keep the initial print simple and test dimensions first.

I'll know tomorrow what refinements if any are needed and can likely get that done and a mark II made if needed while at work.

cheers,
george.

[mikeselectricstuff]

Considering the added complexity of a tool that's easy to adjust while looking atthe screen, I'm wondering how necessary "view while focus" actually is for selecting occasional close-up work.  You can probably just mark the factory/infinity position, and then estimate a few standard fractions of a turn for close-ups - fine adjust is simply moving the camera closer & further to get in focus.

[georges80]

Considering the added complexity of a tool that's easy to adjust while looking atthe screen, I'm wondering how necessary "view while focus" actually is for selecting occasional close-up work.  You can probably just mark the factory/infinity position, and then estimate a few standard fractions of a turn for close-ups - fine adjust is simply moving the camera closer & further to get in focus.

True. I watched your video and it seems a few fixed rotation points are all that is needed and a small holder/tripod to look down on a PCB from a fixed height (that would be my primary use).

Making the tool have a handy grip to hold it to turn is just a case of "easy enough to add in sketchup and to print so why not"

cheers,
george.

[Taucher]

Considering the added complexity of a tool that's easy to adjust while looking atthe screen, I'm wondering how necessary "view while focus" actually is for selecting occasional close-up work.  You can probably just mark the factory/infinity position, and then estimate a few standard fractions of a turn for close-ups - fine adjust is simply moving the camera closer & further to get in focus.

I've seen that you have marked the lens - but actually I'm struggling a bit to get the optimum sharpness/ infinity sharpness set correctly as the field of depth would ideally be just touching infinity, while providing maximum sharpness towards the camera - thereby covering most of the useable range with optimum sharpness.
Getting that setting without a hole to peek through while turning is &%$&/$§!

[dustout]

Does anyone have an i7 config file? Updating the i3's existing configuration lines for mbox and isotherm's enabled and maxCount settings does not seem to be enough to get these features enabled (still no Measurement menu).  Modifying this service mode config file which says it enables the functions for use as the main config doesn't unlock these features either. I expected that this would get that all working. I have full resolution by modifying this so I know the config file itself is properly loading...

Config minus header comments & last two lines:

Code: [Select]

#
.caps entry
.caps.config entry
.caps.config.name text "i3_2012"
.caps.config.revision text "1.0"
.caps.config.image entry
.caps.config.image.sysimg entry
.caps.config.image.sysimg.alarms entry
.caps.config.image.sysimg.alarms.enabled bool true
.caps.config.image.sysimg.alarms.measfunc entry
.caps.config.image.sysimg.alarms.measfunc.enabled bool true
.caps.config.image.sysimg.alarms.measfunc.maxCount int32 6
.caps.config.image.sysimg.alarms.humidity entry
.caps.config.image.sysimg.alarms.humidity.enabled bool true
.caps.config.image.sysimg.alarms.humidity.maxCount int32 1
.caps.config.image.sysimg.alarms.insulation entry
.caps.config.image.sysimg.alarms.insulation.enabled bool true
.caps.config.image.sysimg.alarms.insulation.maxCount int32 1
.caps.config.image.sysimg.measureFuncs entry
.caps.config.image.sysimg.measureFuncs.enabled bool true
.caps.config.image.sysimg.measureFuncs.diff entry
.caps.config.image.sysimg.measureFuncs.diff.enabled bool true
.caps.config.image.sysimg.measureFuncs.diff.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.diff.calcMask int32 65526
.caps.config.image.sysimg.measureFuncs.isotherm entry
.caps.config.image.sysimg.measureFuncs.isotherm.enabled bool true
.caps.config.image.sysimg.measureFuncs.isotherm.calcMask int32 20
.caps.config.image.sysimg.measureFuncs.isotherm.dual bool false
.caps.config.image.sysimg.measureFuncs.isotherm.fixScale bool false
.caps.config.image.sysimg.measureFuncs.isotherm.interval bool true
.caps.config.image.sysimg.measureFuncs.isotherm.invInterval bool false
.caps.config.image.sysimg.measureFuncs.isotherm.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.mbox entry
.caps.config.image.sysimg.measureFuncs.mbox.enabled bool true
.caps.config.image.sysimg.measureFuncs.mbox.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mbox.maxCount int32 4
.caps.config.image.sysimg.measureFuncs.mcircle entry
.caps.config.image.sysimg.measureFuncs.mcircle.enabled bool false
.caps.config.image.sysimg.measureFuncs.mcircle.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mcircle.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.mline entry
.caps.config.image.sysimg.measureFuncs.mline.enabled bool false
.caps.config.image.sysimg.measureFuncs.mline.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mline.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.reftemp entry
.caps.config.image.sysimg.measureFuncs.reftemp.enabled bool true
.caps.config.image.sysimg.measureFuncs.reftemp.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.reftemp.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.script entry
.caps.config.image.sysimg.measureFuncs.script.enabled false
.caps.config.image.sysimg.measureFuncs.script.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.spot entry
.caps.config.image.sysimg.measureFuncs.spot.enabled bool true
.caps.config.image.sysimg.measureFuncs.spot.calcMask int32 514
.caps.config.image.sysimg.measureFuncs.spot.maxCount int32 4
.caps.config.image.sysimg.irMarkers entry
.caps.config.image.sysimg.irMarkers.enabled bool true
.caps.config.image.sysimg.irMarkers.spot entry
.caps.config.image.sysimg.irMarkers.spot.enabled bool false
.caps.config.image.sysimg.irMarkers.spot.maxCount int32 0
.caps.config.image.sysimg.irMarkers.arrow entry
.caps.config.image.sysimg.irMarkers.arrow.enabled bool true
.caps.config.image.sysimg.irMarkers.arrow.maxCount int32 4
.caps.config.image.sysimg.irMarkers.box entry
.caps.config.image.sysimg.irMarkers.box.enabled bool false
.caps.config.image.sysimg.irMarkers.box.maxCount int32
.caps.config.image.services entry
.caps.config.image.services.store entry
.caps.config.image.services.store.enabled bool true
.caps.config.image.services.store.radiometric entry
.caps.config.image.services.store.radiometric.enabled bool true
.caps.config.image.services.store.incompatible entry
.caps.config.image.services.store.incompatible.enabled bool false
.caps.config.image.services.store.incompatible.level int32 0
.caps.config.image.settings entry
.caps.config.image.settings.enabled bool true
.caps.config.image.settings.resIR int32 144
.caps.config.image.settings.fpgaResolution entry
.caps.config.image.settings.fpgaResolution.enabled bool true
.caps.config.image.settings.fpgaResolution.resIR int32 144
.caps.config.hw entry
.caps.config.hw.sdcard entry
.caps.config.hw.sdcard.enabled bool true

[dustout]

Get it from the update pack?

The ix update pack doesn't seem to include any of the configuration files. It's pretty sparse actually other than web interface file updates...

[bookaboo]

Considering the added complexity of a tool that's easy to adjust while looking atthe screen, I'm wondering how necessary "view while focus" actually is for selecting occasional close-up work.  You can probably just mark the factory/infinity position, and then estimate a few standard fractions of a turn for close-ups - fine adjust is simply moving the camera closer & further to get in focus.

Totally agree with this.

If anyone does manage to make a suitable focus tool I'd be happy to buy/donate/kickstart or whatever for one

[mikeselectricstuff]

Get it from the update pack?

The ix update pack doesn't seem to include any of the configuration files. It's pretty sparse actually other than web interface file updates...

The config files are written during factory cal and are not in the FW update. The E8 hack config was created by enabling all the options that were there - I have  a feeling that I also merged options from a ui.cfg file for the pip modes. I'm fairly sure someone here has a real i7, so should be able to ftp off the cfg files.

[London Lad]

I ordered at the weekend from David at PASS as mentioned above.
He's a thoroughly nice guy and did me a great deal. It's well worth giving him a call if you intend buying one of these units.

[Rolli]

Uhh uh - very bad news!!!!!

until now I was silently reading here. But now I need to post: I just got the feedback from a friend. He purchased an E5 in early October but as his display was showing two vertical stripes at the left and right side of the screen, his unit was sent back for repair.

He got it back yesterday afternoon ...... with installed firmware 1.20.3
He tried until now: hack is NOT working anymore!!!  

No secret menu anymore, installation of E8.cfg is not enhancing resolution, serial interface (the one behind the front cover) also not working.

He had to leave now as he is travelling but will post details by himself at the weekend for seeking any advice.

Aaargh  - I already ordered mine a week ago but my supplier had no stock and waits for delivery. If all new units now are having a new fw too, I will need at least two bottles of scotch at once and another one each time when I see my E4 with crappy 80x60 pixel. Oh Lord, why didn't I buy it earlier, why why why? Fu**

Any advise? Is there any supplier who still got stock now? I better should cancel my order then and purchase there quickly.
Anybody want to sell a used one? Please PM me.

[tnt]

Not really surprising ... the hack was pretty easy to fix. I'm sure it's still very possible to hack it, but I will sure as hell not risk upgrading mine to try it. So I guess you're on your own (well, with all the people in the same situation as you).

Did he try just using the installer to flash the old firmware on it ?

[Psi]

"supplier had no stock and waits for delivery"  This is more likely delivery from their supplier.

Flir would get a pretty large number manufactured all at once and then restock the suppliers from a main stock warehouse as they ordered them.

So there's a pretty good chance you'll still get the normal firmware.

Firmware 1.20.3 will be Flirs latest firmware which will be used for their next manufacturing run.
There's no way to know if this has already happened or if they have a pallet of 10,000  V1.18 E4's still waiting to sell.

Considering what we now know about how the E4 works i imagine hacking 1.20.3 would still be quite possible but may require unsoldering the flash chip and doing some out of circuit changes to the config files stored in there. Can anyone remember if the flash is BGA or not?

[olsenn]

Dammit!!! I am in the same boat as Rolli; I have one backordered from tequipment. I will be so angry if they ship me a unit that can't be hacked -- that's the only reason I bought the damn thing

[Hypernova]

Shit, mine is on back order too.

that's the only reason I bought the damn thing

Damn right!

[bookaboo]

No obvious FW info on my camera or packing.

[tinhead]

Can anyone remember if the flash is BGA or not?

no, it is TSOP. But even if it would be BGA, there is still JTAG to i.MX, so not a real problem to burn old firmware dump.
For sure there are config files, so well if there is no way to connect over USB build your own firmware which will backup config files, get dump from ppl who have older firmware, flash it over JTAG and restore your config files - easy as pie (it didn't looks like FLIR made any effort, in current hardware, to prevent their hardware/firmware with security features in i.MX. However, there is still chance that they will, or even change PCB/components. This will eventually happens if they got presure from gov's about potential export/blah/risk what so ever thing).

[bookaboo]

Easiest way of seeing FW info is from the screen menu
Settings > Device Settings > Camera Information

[mikeselectricstuff]

Before anyone starts panicking remember there will almost certainly still be a way to update firmware.

[digsys]

DON'T PANIC ! (Hitch-hikers guide). Now they have an u/dated version, I'd possibly be wary of their Tools, has anyone done
a firmware update on-line?

[lewis]

Don't panic! Don't panic Captain Mainwaring!

We're dooooomed......

[kaz911]

I guess they might be busy on both the i3/i5 and the e40/e50/e60 series as well

[mikeselectricstuff]

I guess they might be busy on both the i3/i5 and the e40/e50/e60 series as well

i series is to all intents and purposes obsolete - doubt there will be any new production.

Obviously the first thing to see is if the firmware update mechanism is still there, to either downgrade to 1.18.7, or reverse-engineer the packet protocol.

There may also be a way in via the boot menu on the debug port - if we can find what format of file it's looking for and create that from the 1.18.7 package that may also be a way in.

And of course there's still the zero-day option - FPGA on the raw datastream...

[olsenn]

Even assuming the didn't remove the ISP/JTAG headers, is an old .hex file (or however it manifests itself) available? Would a TL866 universal programmer be capable of programming this?

[olsenn]

So in other words I should cancel my order now

[mikeselectricstuff]

Can anyone remember if the flash is BGA or not?

no, it is TSOP. But even if it would be BGA, there is still JTAG to i.MX, so not a real problem to burn old firmware dump.
For sure there are config files, so well if there is no way to connect over USB build your own firmware which will backup config files, get dump from ppl who have older firmware, flash it over JTAG and restore your config files - easy as pie (it didn't looks like FLIR made any effort, in current hardware, to prevent their hardware/firmware with security features in i.MX. However, there is still chance that they will, or even change PCB/components. This will eventually happens if they got presure from gov's about potential export/blah/risk what so ever thing).

Reprogramming the flash is not so simple due to the issue of bad-block mapping and ECC - a straight image from one unit would almost certaonly not work on another. It would need to be read & parsed with the knowledge of how WinCE manages the flash, and then reconstructed. Easiest way would probably be to connect it up & mount on another WinCE system.

BTW I've not ID'd a JTAG connector but I think there are enough unidentified pins on the FFC , and tehre is also that unpopulated FFC con to investigate.

and don't forget that even in it's unhacked form, it's still a good tool!

Bear in mind that the one unconfirmed report from a new user relates to a unit that was sent back for repair, so we don't know what is in the current supply chain (though we know the chain is short from the recent cal dates).

I did think that it might have been worth sitting on the CRC01 stuff for a while.... Oh well let's just wait & see.  I won't be looking into it too hard as I have an Audi automotive unit to play with, and a new 400,000 LED installation to start designing