Flir E4 Thermal imaging camera teardown

[daves]

"the production process was improved"  What is that really mean ?

Just that they cant call it "antihack"

[ron]

Interesting news on Firmware updates - please read....snip

I suppose they wouldn't be good enough to divulge at which serial number or date this "improvement" was implemented.    That would be helpful

[Fraser]

The cost of a recall to service centres is not without significant cost in postage and man hours. FLIR are taking this more seriously than I expected. You can be certain that if your E4 is ever returned to FLIR it will get 'upgraded' to the latest firmware as a matter of policy.

I was interested to read that there is a backlog of units being 'upgraded'... I wonder if this is warehouse stock or whether stock has been recalled from retailers ?

On the topic of V1.21.0 firmware, I cannot believe that FLIR would release it on their web site for download if it was not compatible with earlier builds. Especially as they removed the version 1.18.7 download........ Sooooooo, I deduce that, as Mike suggested, FLIR want to get their paws on parts of the OS or firmware that they cannot access via a firmware update. This could be a 'belt and braces' approach to the countermeasure rollout.

[lignumaqua]

Thank you, that's very helpful! 

@lignumaqua,

1.19.8 is not available to download from FLIR or AFAIK anywhere else.

FLIR have stated that the differences between 1.18.7 and 1.19.8 is purely production related with apparently no bug fixes. I asked FLIR for firmware 1.19.8 and have not received a response to date. You will be just fine with 1.18.7 

[tomas123]

It would appear that upgrading to V1.21.0 firmware requires your E4 to be returned to FLIR !

hm, nobody yet tested the version 1.21.0

there is a inconsistency - while the update the FW 1.21.0  dosn't overwrite your config file
I see two variants:

• you can use furthermore the old crc01 keygen for editing your config file (but flir blocked self settings .caps.config.image.settings.IRwidth and .caps.config.image.targetNoise.targetNoiseMk)
• you need a new config file with the upgraded crc+ ->  this requires your E4 to be returned to FLIR

I don't think, that the flir updater generates the new crc+ for a upgraded config file ;-)

[pomonabill221]

Why would anyone need the "production upgrade" if yours was already produced?
hhmmm.....

[Primus]

I ordered an E4(6391-0101) off of eBay on Saturday, contacted the seller and they got the stock on Feb 6th. It was listed on eBay a firmware 1.18.7 - here's hoping they are correct! Ugh, I hate the anticipation! The 5 of those that they had are now sold out, and the other listings show a delivery backlog of Mar-Apr 1; I'd be surprised if aren't "fixed". I just hope to see "shipped" on my E4 here today or tomorrow, if so, my worry might be alleviated somewhat!

Oh, and great work on this hack even if it turns out to be short-lived! I'll be sure to give an update once I receive the unit.

[Taucher]

It would appear that upgrading to V1.21.0 firmware requires your E4 to be returned to FLIR !

hm, nobody yet tested the version 1.21.0

there is a inconsistency - while the update the FW 1.21.0  dosn't overwrite your config file
I see two variants:

• you can use furthermore the old crc01 keygen for editing your config file (but flir blocked self settings .caps.config.image.settings.IRwidth and .caps.config.image.targetNoise.targetNoiseMk)
• you need a new config file with the upgraded crc+ ->  this requires your E4 to be returned to FLIR

I don't think, that the flir updater generates the new crc+ for a upgraded config file ;-)

I'm convinded that if the programmer(s) had to go so far as to write a new CRC algo or two... then the task is very clear: get rid of any chance of hacking - this would for me include a routine to sanity-check the config files before converting them to the new CRC (and even on every loading after that) - and I'd need a "known good" reference for that - at least something like eeprom contents for label, model, SN etc...
... and the next step would be a HW change to stop the eeprom beeing EE and make it a ROM (at least remove (and change) the factory password from the firmware so it needs to be supplied from the outside) - problem solved until somebody decides patching binaries, reversing the CRC again etc. etc. etc.

[Taucher]

Why would anyone need the "production upgrade" if yours was already produced?
hhmmm.....

The answer is "beeing uninformed" or some stupid psychology wanting the "latest and greatest" (which is of cause always the stuff with the highest number... *haha*)
... my footer "avoid" summarizes my suggestion how to behave

[Taucher]

Could be  they're updating the bootloader or other hard-to-access stuff.

Actually they seem to do so / to have done that - "bootloader"-related strings appeared in context of "locked" ...

[mikeselectricstuff]

Why would anyone need the "production upgrade" if yours was already produced?
hhmmm.....

..or course the new FW on the Flir site could just be a joke to waste all our time looking at it...

I wonder if at some point Flir tools will refuse to work with old FW..?

[pomonabill221]

Why would anyone need the "production upgrade" if yours was already produced?
hhmmm.....

The answer is "beeing uninformed" or some stupid psychology wanting the "latest and greatest" (which is of cause always the stuff with the highest number... *haha*)
... my footer "avoid" summarizes my suggestion how to behave

Yes... I was being sarcastic actually...   
true, there are those that HAVE to have the "latest and greatest" for bragging rights, if nothing else! 

[mikeselectricstuff]

BTW just wanted to say a quick "Hallå" (Hello)  to all the FLIR people watching this thread -  hope you're enjoying doing all that new work on a project you'd thought was finished and out the door...!
Don't you just hate it when that happens..?
 

[Fraser]

Awwwww Mike that is just plain mean. I have no problem with FLIR employees. They are the people who have made a sub $1K 320x240 thermal imager possible. They could have gone the cheapo route and used some awful 80x60 micro-bolometer but no, they used a quality product.

I thank the design team for their excellent work and hope that they understand that I appreciate their hard work and skills. The software  engineers may actually have enjoyed revisiting the product, as in a game of Chess .... mind Vs mind  

They also gave us the E4 in its upgradeable form for a whole 4 months with no silly knee Jerk reaction in that time frame. I can't blame them for what they are believed to be doing, and knowing FLIR, it will be done well, now that they have focussed on the issue.

[ixfd64]

I'm sure there will always be a way to hack the device. Apple iOS jailbreaking, anyone?

[amigo]

So, basically the situation is even more dire than we thought, and that 60fps hack is probably as easy as pie. Thus, FLIR is now trying to "salvage" the issue as fast as possible before their a$$ gets roasted by the regulators.

Of course the competition probably has their gears turning at the moment, too, because if FLIR did not secure their software, most likely others had failed to do it as well. It's all about cutting production costs and increasing revenues...After all who would even think to hack a TIC, right?

The real issue is the idiotic regulation that limits certain features and capabilities, because "terrorists" might use them. Ultimately, it is our collective fault for allowing a small gang of crooks who are in charge to run circles around us, and pull wool over our eyes. Remember folks, "the war on terror will not end in our lifetimes."

But I digress, who's up for that 60fps hack?

[Lu]

Question about the battery.  Every time I take the battery out, using or without using camera for a while. It smells weird, a little like burning plastic or new plastic,  but not very strong.  The temperature feels okay, even right after using the camera, it does not feel too warm. A 2-3 hours charge could last about 2-3 hours camera time.  The smell is bothering me. Is this an issue or all the flir camera is like that ? 

Thanks

[pomonabill221]

Question about the battery.  Every time I take the battery out, using or without using camera for a while. It smells weird, a little like burning plastic or new plastic,  but not very strong.  The temperature feels okay, even right after using the camera, it does not feel too warm. A 2-3 hours charge could last about 2-3 hours camera time.  The smell is bothering me. Is this an issue or all the flir camera is like that ? 

Thanks

I have noticed this also.  I have also checked the temp of the battery and it is cool so I think it's just the plastic outgassing.
I even leave the battery out of the camera just to make sure, and it still has a little odor like "hot plastic" or "hot electronics".  Don't think there is anything to worry about though.

[emptech]

I've never noticed any unusual smells with my e40, but it is a couple years old now.  Somebody mentioned it could be the plastic
out-gassing.  There is a chemical in plastics called a "plasticizer."  A plasticizer is a chemical that keeps a plastic flexible.  It is that
"new car smell."  When a plastic gets old, some of the plasticizer leaves, making the plastic more brittle.

I suspect the smell is from some components over-heating, again, some of that smell may go away with time.  The charge rate of
a lithium-ion battery has to be tightly controlled, often the current/voltage control is on a circuit board within the actual battery, to
keep tight control of the charging current.  Hopefully, it is that "new car smell" and will go away somewhat as the components age.

Cheaper circuit boards use paper-resin, not glass-epoxy and often have that "burning" smell.  I don't know what the pcb material
is in Flir's batteries.

Hope this helps -  Jim

By the way, I thought I came close to bricking my e40, but because I had all the files backed up and was able to restore them to the
camera via RNDIS through the USB, I'm 1000% up.  It now has all the behavior of an e60, even says e60  in the information display.
All I need now is a new label, blue on black, "E60."  The best I can do with my Brother label maker is white on clear.

Jim

Question about the battery.  Every time I take the battery out, using or without using camera for a while. It smells weird, a little like burning plastic or new plastic,  but not very strong.  The temperature feels okay, even right after using the camera, it does not feel too warm. A 2-3 hours charge could last about 2-3 hours camera time.  The smell is bothering me. Is this an issue or all the flir camera is like that ? 

Thanks

[Jaimslaw]

FWIW, Successful REZ upgrade on the following E4 Model: 

Ver. No  E4 1.1
S/N of 639137XX
Firmware of 1.19.8
Build date of 1/30/2014
Purchased on Amazon last Friday (they are out now - at the time of my order, they had 13).

Question: A 2nd E4 I bought for my company did not take the hack.  I used Wordpad as the text editor - probably one possible problem (used a freeware text editor and everything went fine for the 2nd camera).  Anyways, on the one that didn't take, it did go through its updated e8.cfg message - just no enhanced resolution.   In making a 2nd attempt, can I just try the hack again -  or should I run the Remove_hack" fif file and then take another stab at it?  It would seem that re-doing the hack is just an update of that e8 config file.

Thanks go out to all you Master Programmers who have come up with - but a thumbs up as well to those providing a tad more explanation (i.e., anti bricking clarification) https://www.eevblog.com/forum/Smileys/default/smiliey_cal.gif

[Taucher]

Question: A 2nd E4 I bought for my company did not take the hack.  I used Wordpad as the text editor - probably one possible problem (used a freeware text editor and everything went fine for the 2nd camera).  Anyways, on the one that didn't take, it did go through its updated e8.cfg message - just no enhanced resolution.   In making a 2nd attempt, can I just try the hack again -  or should I run the Remove_hack" fif file and then take another stab at it?  It would seem that re-doing the hack is just an update of that e8 config file.

As always: read the instructions (again and again) - remember the hack is tied to the serial number so maybe forgot to change it?
... and again: check out EzCRC01 (see my footer) if you have problems computing the correct CRC01

Also: tell us which SW version your camera "to be hacked" has - and keep e8.cfg with lowercase "E".
If you're using RNDIS mode (recommended) then you can FTP the config directly without the need for a .FIF.

[pomonabill221]

I really like the ezcrc!  Asks questions as it runs so it is a little more "fool proof" and guides you as it runs.
Thanks Taucher for that!

[Osiris454]

Since FLIR seem to be clamping down in the E4 modification, does this have any affect on the E40's? The E40's have been out a few years, is it safe to say that they will not bother this model?

[Taucher]

Since FLIR seem to be clamping down in the E4 modification, does this have any affect on the E40's? The E40's have been out a few years, is it safe to say that they will not bother this model?

I'd expect Exx becoming "hackproofed" as well - the urgency with E4 seems higher due to lower pricepoint.

[pomonabill221]

I had replaced my battery with a higher capacity battery so I decided to unsolder the board in the pack and take some close up shots.
Here ya go.
Lighting was a little tough... sorry for the quality.
There are two fets wired in parallel.
I don't know what the small chip is, but guess it is a regulator?
R3 is a 10k NTC thermistor.
The two fets are upside down because this was the way I could get good lighting, but you can read the number.