Flir E4 Thermal imaging camera teardown

[Pinkus]

By the way:
When looking at the JPG EXIF information of a picture, there is noted 'E4' as camera model and some more information like lens, distance etc.
You might rename E4 to E8 in an EXIF editor and you might think you did it, but ... in Flir Tools it is still showing "E4" and also the serial number of the camera is shown there. So there are some more information hidden somewhere.
Does anybody have an idea how to get rid of these informations (by not loosing the other informations Flir Tools are using e.g. digital camera picture, temperature span etc.)?

[BravoV]

By the way:
When looking at the JPG EXIF information of a picture, there is noted 'E4' as camera model and some more information like lens, distance etc.
You might rename E4 to E8 in an EXIF editor and yiu might think it is OK, but ... in Flir Tools it is still showing "E4" and also the serial number of the camera is shown there.
Does anybody have an idea how to get rid of these informations (by not loosing the other informations Flir Tools are using e.g. digital camera picture, temperature span etc.)?

Assuming you use Window, freeware, get this -> http://freeweb.siol.net/hrastni3/foto/exif/exiftoolgui.htm

Use the Remove Metadata sub menu to clear any stickied attributes from a photo.

[_Sin]

One thing to check - the main obvious bug in the older FW is it doesn't show time/date in the file information - is this fixed in 1.19?

No, it's not showing that on the device (you're right, this makes no sense from a UI perspective). It bakes it correctly into the file though, so it's OK when viewed elsewhere (though I have yet to work-out/RTFM how to view both the normal and thermal images when browsing files - it shows both on the camera, but the JPEG image appears only to contain the thermal image)

[equinoxe]

BTW. Is there a way to remove the "flir" branding from the image?
It's nice when you are senile and need to be remembered which brand camera you have, but otherwise it's useless, takes up measurable space and quite frankly I think it's rather annoying..

[mikeselectricstuff]

Another possible feature for a MCU add-on - timelapse mode.
You could maybe also do auto shoot on detection for wildlife/security by looking for a rise in the temp scale (you can read this via level and span commands).

Good idea. I could not find the possible/allowed UART commands / parameter in this thread but I may have overseen them (due to the size of 46 pages I did just a quick scan). Can you please point me to the correct place or restate them? Thanks

Oh, and I am sorry for your cable! On long term it might be better to repair with another short FPC cable (add solder on one cable, then place contacts to contacts of old/new cable and heat from the top, that works pretty well).

It's the T59504PDF linked here
https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg316284/?topicseen#msg316284

Thanks Mike.
I assume it is chapter 4.2.4.5 on page 59.
But how do I send the command?

Like this below if I want a span from 0°C to 100°C (=273 / 373 Kelvin)?

38400 Baud; ASCII through RS232 interface:
"rset .image.contadj.adjMode manual CR/LF"
"rset .image.sysimg.basicImgData.extraInfo.lowT 273 CR/LF"
"rset .image.sysimg.basicImgData.extraInfo.highT 373 CR/LF"

Thats all?
Is CR and LF correct or only CR?

I don't know if you can do it with rset  -there are "level" and "span" commands which definitely work

[Pinkus]

Assuming you use Window, freeware, get this -> http://freeweb.siol.net/hrastni3/foto/exif/exiftoolgui.htm
Use the Remove Metadata sub menu to clear any stickied attributes from a photo.

Thanks. I knew this program before, but not the GUI. That makes it a lot more comfortable!
But .... not working :-(
Of course it then removes everything ... but also all embedded information you might need in Flir tools.

I could see beside the sections JFIF, EXIF etc. there is a section called APP1 (see below)
Now the question is: how can I edit APP1 without deleting everything? It seems I do not have the chance to edit any single entry of this APP1 section with this tool.

---- APP1 ----
Emissivity                      : 0.95
ObjectDistance                  : 1.00 m
ReflectedApparentTemperature    : 20.0 C
AtmosphericTemperature          : 20.0 C
IRWindowTemperature             : 20.0 C
IRWindowTransmission            : 1.00
RelativeHumidity                : 50.0 %
PlanckR1                        : 14469.053
PlanckB                         : 1392.2
PlanckF                         : 2.5
CameraTemperatureRangeMax       : 250.0 C
CameraTemperatureRangeMin       : -20.0 C
CameraModel                     : FLIR E4
CameraPartNumber                : 63901-0101
CameraSerialNumber              : 639047xx
CameraSoftware                  : 22.0.0
LensModel                       : FOL7
LensPartNumber                  :
LensSerialNumber                :
FieldOfView                     : 45.0 deg
FilterModel                     :
FilterPartNumber                :
FilterSerialNumber              :
PlanckO                         : -7489
PlanckR2                        : 0.026838331
RawValueMedian                  : 12412
RawValueRange                   : 632
DateTimeOriginal                : 2013:10:26 13:06:58.710+00:00
FocusStepCount                  : 70
FocusDistance                   : 0.0 m
PaletteColors                   : 224
AboveColor                      : 170 128 128
BelowColor                      : 50 128 128
OverflowColor                   : 67 216 98
UnderflowColor                  : 41 110 240
Isotherm1Color                  : 100 128 128
Isotherm2Color                  : 100 110 240
PaletteMethod                   : 0
PaletteStretch                  : 2
PaletteFileName                 : \FlashBFS\system\iron.pal
PaletteName                     : Iron
Palette                         : (Binary data 672 bytes, use -b option to extract)
RawThermalImageWidth            : 80
RawThermalImageHeight           : 60
RawThermalImageType             : PNG
RawThermalImage                 : (Binary data 5779 bytes, use -b option to extract)
Real2IR                         : 1.33978033065796
OffsetX                         : -12
OffsetY                         : +0
PiPX1                           : 0
PiPX2                           : 80
PiPY1                           : 0
PiPY2                           : 60
EmbeddedImageWidth              : 640
EmbeddedImageHeight             : 480
EmbeddedImageType               : DAT
EmbeddedImage                   : (Binary data 25074 bytes, use -b option to extract)

P.S. If anybody wonders: the above has been copied on a picture of an unhacked E4 (thats why 80x60) but will be the same with a hacked one (beside the resolution, which will be shown correctly as 320x240 then).

EDIT: the string E4 and the serial number can be found and edited with a HEX editor. So there is just a tool needed which can show and edit App1 section.

[Pinkus]

BTW. Is there a way to remove the "flir" branding from the image?
It's nice when you are senile and need to be remembered which brand camera you have, but otherwise it's useless, takes up measurable space and quite frankly I think it's rather annoying..

If you remove all Metadata as explained above, the Flir logo is gone. But keep a copy as every other information of the file is gone then too.

EDIT: mmmh - I tried it again, now the logo stays. Probably I wrote crap. Just ignore the above.
Another solution: Open your file in Flir tools. Logo etc. are gone and you can adapt the picture as you like. Now make a screen copy of the picture-screen area and save as JPG. But your usual large temperature reference is also gone now - you may copy it with the narrower one of Flir tools. No other way as Flir does not allow a "save" of the plain picture here.

[Scutarius]

Is there anyway FLIR can patch this hack? I want to buy one but, unfortunately,  not this year... 

[tnt]

Is there anyway FLIR can patch this hack? I want to buy one but, unfortunately,  not this year... 

As mentionned earlier ... yes, plenty of ways. Especially for new camera. But even if you updated the fw on a old one there is plenty of things they could do.

Would it be un-hackable ? Doubtful, but they could make it really painful and then you'd need motivated people that don't already have an hacked one to get to work on it ... Actually now that I think on it, doing it only for new cam might be a good technique ... I'm sure several people (me for eg) wouldn't spend any time looking at bypassing a new protection scheme if the old bypass kept working on my camera ...

[m4rkiz]

some basic i3 info from different posts in this thread collected together for newbies like me

simple solution that changes i3 temporarily to i7 but doesn’t void warranty as there no modifications to camera at all
- turn on camera
- press left menu button once
- press gallery (play) button for 5 seconds

you should have ‘diagnostic’ screen open

- under left menu, change usb mode to RNDIS
- install flir drivers http://cdn.cloud.flir.se/swdownload/assets/other/flir_device_drivers.exe
- connect camera to your pc

(at this point it should install as network card with dhcp active and camera should be accessible through www [port 80, there is also few more things active – check 3rd page of http://www.imc-store.com.au/v/vspfiles/assets/images/flir%20a310%20technical%20notes.pdf ] rtsp stream is obviously not available)

- open your browser and navigate to http://192.168.0.2 then activate service mode – user:flir password:3vlig
- give it 30-40 seconds without pressing any keys, it will reboot and it will have i7 angles and resolution on the screen

those changes are reversed with every reboot so reset it with a switch or let it turn off when you are done with it

sample pictures from my i3

all informations quoted here were provided in this thread by various users, thanks lads

BTW, is there any way to reboot it without using hardware switch in battery compartment or waiting until it powers down by itself - long press on power button don't work for me at all

[mikeselectricstuff]

Get' em while you can -Tequipment stock went from 12 yesterday down to the last one in stock today!

[scibit]

Ordered mine earlier today 

[all_repair]

Just sent in an order.  Remember to ask for the discount code.

[scibit]

Forgot to at the time, but I just contacted them and they changed it down to $895

[ViciousPest]

Forgot to at the time, but I just contacted them and they changed it down to $895

Ordered mine last night. Do you think its too late for me to get discount? What did you say when you called? Thanks for any help you can provide

[ViciousPest]

What are some "to-dos" for the hack? Getting the E8 feature set has been done much thanks to Mike. What are other things people have requested? I have experience with REing embedded systems (although none with Windows CE) and am looking forward to modifying mine. One of the main reasons I decided to buy one IS because there is still functionality to add. Here is list of things that I gathered from the posts/video:

• Hot Swap Button (from thermal to live view)
• Temperature Adjustment
• Refresh rate unlock?

Again any insight or additions you can provide would be appreciated.
Some questions:
Is the refresh rate hardware restricted or software?
Regarding temperature adjustment, this is achieved via serial commands correct?

[scibit]

Forgot to at the time, but I just contacted them and they changed it down to $895

Ordered mine last night. Do you think its too late for me to get discount? What did you say when you called? Thanks for any help you can provide

I don't think my order had been processed yet. I just used the live chat on the website and said that I'd been quoted it cheaper on another site, then asked if it was too late to take advantage of their price match guarantee.
They just wanted to know where I got the quote from and were happy update my order to match it.

[Scutarius]

Is there anyway FLIR can patch this hack? I want to buy one but, unfortunately,  not this year... 

As mentionned earlier ... yes, plenty of ways. Especially for new camera. But even if you updated the fw on a old one there is plenty of things they could do.

Would it be un-hackable ? Doubtful, but they could make it really painful and then you'd need motivated people that don't already have an hacked one to get to work on it ... Actually now that I think on it, doing it only for new cam might be a good technique ... I'm sure several people (me for eg) wouldn't spend any time looking at bypassing a new protection scheme if the old bypass kept working on my camera ...

Too bad, I can't afford it right now.

[olsenn]

My tequipment order is still listed as being "on hold". When I ordered there were 12 in stock; now there's only 1. I will be severely pissed if they didn't reserve one for me. Hulk Smash!

[ixfd64]

OT / @Cable: this reminds me of a 140 DM (yes, long long ago - nowadays it would be 140€) iLink(aka Firewire) cable (1,5m) ... specialty: was branded Sony and had a nice purple plastic instead of generic black ... of cause it was next to the camcorders ... approx 20m distance to the normally overpriced cables

Kind of reminds me of the $1,000 Ethernet cable: http://www.amazon.com/Denon-AKDL1-Dedicated-Cable-Version/dp/B000I1X6PM

[mikeselectricstuff]

What are some "to-dos" for the hack? Getting the E8 feature set has been done much thanks to Mike. What are other things people have requested? I have experience with REing embedded systems (although none with Windows CE) and am looking forward to modifying mine. One of the main reasons I decided to buy one IS because there is still functionality to add. Here is list of things that I gathered from the posts/video:

• Hot Swap Button (from thermal to live view)
• Temperature Adjustment
• Refresh rate unlock?

Again any insight or additions you can provide would be appreciated.
Some questions:
Is the refresh rate hardware restricted or software?
Regarding temperature adjustment, this is achieved via serial commands correct?

Not known if framerate is changeable but no reason for it to not be baked into the FPGA, especially due to the ITAR issues.
The only thing I've seen relating to framerate is the  "Allow_30Hz" or similar message in the bootup text, but this may just be a status readout from the FPGA.

[ron]

Get' em while you can -Tequipment stock went from 12 yesterday down to the last one in stock today!

If they really had only one left, then they have none now because I ordered one 2 minutes ago.
Cheers Mike!

[Pinkus]

FYI: If you are not from the US, don't bother Tequipment or Optimum Energy Products (shopflir.com) with a request for quote. They both do not ship the Flir E4 to non-US countries. But it can take a day or two until they answer your mails and during this waiting-time other available E4 might be gone.
Their answers for several requests were:

Flir don't want us selling into other dealers regions.
and
... Unfortunately, we are not allowed to supply FLIR products into your territory.
and
...as we do no send thermal cameras outside of the US as per federal law

In Europe there are enough available .... but +30% more expensive

[ixfd64]

You could still have it shipped to a trusted U.S. resident and have them forward it to you.

[mikeselectricstuff]

FYI: If you are not from the US, don't bother Tequipment or Optimum Energy Products (shopflir.com) with a request for quote. They both do not ship the Flir E4 to non-US countries. But it can take a day or two until they answer your mails and during this waiting-time other available E4 might be gone.
Their answers for several requests were:

Flir don't want us selling into other dealers regions.
and
... Unfortunately, we are not allowed to supply FLIR products into your territory.
and
...as we do no send thermal cameras outside of the US as per federal law

In Europe there are enough available .... but +30% more expensive

valuetesters claim to ship internationally, and a couple of pages ago here someone mentioned a $100 discount for the asking