Flir E4 Thermal imaging camera teardown

[Jaimslaw]

I did read every one of the 30 posts that mentions the word BACKUP  and looked at other forums before I threw out the backup questions.  Just saying that none of those posts mention having gone thru an undo process, or how that worked out for them. 

And sure, user error probably a way to characterize getting file transfer errors, but it is of interest to those of us following  file backup procedures common to FileZilla but still getting those file transfer errors.  Ive used that backup method to back up web site files without these kind of errors.

Maybe someone else can comment..

[pomonabill221]

I thought I read several posts back, that if you log into the camera from filezilla as "root" and "3vlig" instead of "flir", you can access the locked files for backup?
Is this correct?

[Taucher]

I thought I read several posts back, that if you log into the camera from filezilla as "root" and "3vlig" instead of "flir", you can access the locked files for backup?
Is this correct?

You need to know that Windows CE has "ROM" files and can mix read/write files with ROM files (even overlay them) - that's to conserve space and allow some fancy IT-tricks.
I suggested using root as login as it can see root owned files while flir can't - whether your Ex has such files will show after you did a backup using root and a backup using flir, then compare those backups (I didn't do that yet).

[Taucher]

I did read every one of the 30 posts that mentions the word BACKUP  and looked at other forums before I threw out the backup questions.  Just saying that none of those posts mention having gone thru an undo process, or how that worked out for them. 

And sure, user error probably a way to characterize getting file transfer errors, but it is of interest to those of us following  file backup procedures common to FileZilla but still getting those file transfer errors.  Ive used that backup method to back up web site files without these kind of errors.

Maybe someone else can comment..

Well, then check out "restore" or "de-brick"  ... I personally guided a de-brick (remote connection) - the backup files were needed to restore config data after a full "delete" where just basic components (undeleteable) had survived.

The read errors just happen with ROM files - Windows assumes you won't need to copy them as they are not changing and disallows copying them -> one has to use extraction techniques to snoop into them ... fortunately they are included in the firmware file anyway.

[Jaimslaw]

Thanks for heading me to those posts for a re read. I had read all de bricking posts but guess i was missing out on any gems about the backup process.

I suspect that a reversion to stock E4 condition (rez and menu hacks), is a little more than simply replacing or overwriting the two camera folders that contained mods for the two enhancements.  That logic does have some appeal.

I did read somewhere on FileZilla forums that 550 file transfer errors occur with both locked server files as well as with files that dont exist, and was thinking this to be the case becuz so many camera folders are empty.  But closer look at the file error strings does indicate those are files that are locked out.  Will try the root/ vlig method,

Will be doing more thorough reading on this topic before posting again.  Not looking for a tutorial or anything along those lines.  Probably many viewers interested in this aspect of the teardown. I suspect more posts will come to light about the BK and restore process as warranty work is sought in the future.

But its all good stuff.

[mrflibble]

And sure, user error probably a way to characterize getting file transfer errors, but it is of interest to those of us following file backup procedures common to FileZilla but still getting those file transfer errors.

User error is indeed how I characterize getting file transfer errors due to using incorrect paths like ".../FlashBFS/FlashBFS/...".

[Jaimslaw]

And sure, user error probably a way to characterize getting file transfer errors, but it is of interest to those of us following file backup procedures common to FileZilla but still getting those file transfer errors.

User error is indeed how I characterize getting file transfer errors due to using incorrect paths like ".../FlashBFS/FlashBFS/...".

Agreed, but the Filezilla backup process makes that somewhat impossible if using conventional filezilla backup methods. 

Will try doing a backup using Pomonnabills suggestion of replacing "flir" with "root" and will also dig around in some of those unbricking posts to see if those 550 file transfer errors go away during the FTP backup.

I was hoping the reversion to e4 stock condition would be an easier process that say, going through a hand wringing unbricking process.  But if thats what it takes, we all  potentially face that prospect if warranty work should be required.   It is what it is, no doubt.

[Fraser]

Warranty work ?  .... only if you don't mind reverting back to a standard E4 with little prospect of returning to 320x240. It has always been FLIR policy to install the latest firmware version during a repair. They MAY obey as instruction to not do so, but I would not count on it. Probably better to buy another E4 with 1.21.0 and use it as a parts donor to fix a 1.19.8 version 

[OrBy]

It would be really nice to see if there have been any visible hardware changes from 1.0 to 1.1 to 1.1L.

How FLIR would go about stopping a 1.21 to 1.18/1.19 re-flash would likely be in the boot ROM some where. Could that be overwritten out of band some how and allow the newest units to be unlocked is a question we wont even have a chance to answer till we have some data to compare them with.

New hardware needs to be sacrificed to the gods of Phillips and JTAG.

[mikeselectricstuff]

It would be really nice to see if there have been any visible hardware changes from 1.0 to 1.1 to 1.1L.

How FLIR would go about stopping a 1.21 to 1.18/1.19 re-flash would likely be in the boot ROM some where.

The return-to-base stuff would suggest something like bootloader changes. I would also not be surprised to see some kind of warranty seal.

Another way that downgrading could be hindered is to make changes to the way the cal data works, and maybe format of eeprom data - I don't recal what happens if the current version sees a bad checksum on eeprom data.

[Fraser]

Changes to software in the E4 is fraught with risk unless the coder knows exactly what countermeasures are in play. FLIR could easily include checksum countermeasures to counter attempts to modifiy the build in any way except via legitimate ugrade paths and content. Finding someone willing to risk their E4 becoming an expensive brick is part of FLIRS countermeasure ! Very few, if any, new E4 owners will want to take such a risk with $1000+ without some idea of the risk thay are taking.

One option would be for a group of people who want a 320x240 E4 to get together and share the cost of a sacrificial new E4 with 1.21.0 loaded. The unit may then be experimented upon by persons with the required coding abilities. Hopefully the experimental E4 would still be in useable condition after the investigation is completed. It may then be sold on an auction site and the funds divided between the 'investors' to put towards their purchase of a new E4. There is the very real possibility that the 4 cannot be 'cracked', in which case the exoerimental unit may be sold and some of the investment recovered for the investors. Sometimes you have to take a risk and invest in order to reap the rewards. There would also be the possibility that the 'investors' could offer the experimental E4 to the skilled coder as payment for the time that the investigation will take and the capability that will be released in terms of upgrading other E4 units.

The challenge would be finding someone with the skill set needed for the investigation who has the amount of time that would be needed for such. Mike, Taucher and the others in the E4 upgrade 'Team' have been very generous with their time already and likely have day jobs to pay the bills.

[ixfd64]

I think the new cameras most likely use some kind of code signing. This allows them to accept future firmware updates from FLIR while disallowing unofficial modifications. The signing key could probably cracked with a community effort if it isn't stronger than 768-bit RSA. If all else fails, there are always modchips.

[Taucher]

I think the new cameras most likely use some kind of code signing. This allows them to accept future firmware updates from FLIR while disallowing unofficial modifications. The signing key could probably cracked with a community effort if it isn't stronger than 768-bit RSA. If all else fails, there are always modchips.

Navigation devices took this approach with their maps etc... result: firmwares "need" a patch and then a keygen with known private key will allow any map the user gets his hands on.

[tom66]

I've said it before, I think a kickstarter would work for this.
The investment idea seems too complex, just have many people donate £10 to £20 each and you'll have an E4 in no time...
The E4 can be sold on, and funds donated to a worthy charity, or it can be kept, for future experimentation.

[mikeselectricstuff]

I've said it before, I think a kickstarter would work for this.
The investment idea seems too complex, just have many people donate £10 to £20 each and you'll have an E4 in no time...
The E4 can be sold on, and funds donated to a worthy charity, or it can be kept, for future experimentation.

Maybe, but I'd expect either KS to reject or Flir's lawyers to pressure them to do so.
There's also the issue of what the deliverable would be - it could easily be nothing. Maybe something for  Indiegogo then 
 
I have considered the idea of a KS to buy something for teardown, but not yet come up with anything with a suitable interestingness-to-cost ratio.   

[ixfd64]

You could always have the funds managed by a trusted member of the community instead.

[DaveWB]

I know there were a few people who said they would donate 100 Dollars/Euros. I would also donate $100.

[dtbp]

Post 4000! Wow this is a huge thread. That is all.

[Macnasien79]

I would donate another US$100.

[echen1024]

I bought one last week from Bell NW that has firmware 1.19.8. They still have 1 more left. Let the fight ensue. 

[pwherry]

I'm one of the folks who bought an E4 as a result of this thread and was able to easily and successfully modify it; I'm very grateful to the folks who made this possible.

I want to state that I'm in for $100 (as a simple donation, not some sort of "investment") if the project moves forward to acquire/hack a unit with firmware 1.21. I understand there's a substantial risk of failure in this endeavor and am nonetheless willing to contribute.

Since FLIR has shown at least some willingness to engage in an arms race with the hacker/enthusiast community, it's my expectation that the unit purchased for this endeavor might be useful in dealing with future firmware updates, too.

[Taucher]

Recalling that some less ethically thinking folks did some buy-hack-sell jobs on ebay and made a multiple of the original investment - and that they didn'share back with the community - well, that gives me motivation not to help them in their efforts. If anybody should donate money for a "hack me"-cam, then those guys.

[Fraser]

@Taucher,

Totally agree with you but sadly they are the 'takers' in life, and likely want the new E4's to remain imune to user upgrade so that the can continue to sell earlier firmware models at even greater profit margins. 

[Taucher]

@Taucher,

Totally agree with you but sadly they are the 'takers' in life, and likely want the new E4's to remain imune to user upgrade so that the can continue to sell earlier firmware models at even greater profit margins. 

... in case that they manage to get hold of them - who's willing to sell a hacked/hackable E4 to them?

[Arlo1]

I don't even have the option for a Ebay flip I bought the last hackable E4 I could find in Canada. 
But I would also be in for some sort of donation even though I agree the guys on ebay should be on the hook for most of it considering they are making big coin on this for about 1 hour work!
But I was wondering I edited the boot logo but I can only get the logo to change that the camera flashes from a hard boot.  The other one stays the same no matter what.   Anyone know if that main logo can be replaced?  I have a feeling it can't because when I bricked my camera it was the only thing still there.