Flir E4 Thermal imaging camera teardown

[all_repair]

I've said it before, I think a kickstarter would work for this.
The investment idea seems too complex, just have many people donate £10 to £20 each and you'll have an E4 in no time...
The E4 can be sold on, and funds donated to a worthy charity, or it can be kept, for future experimentation.

Maybe, but I'd expect either KS to reject or Flir's lawyers to pressure them to do so.
There's also the issue of what the deliverable would be - it could easily be nothing. Maybe something for  Indiegogo then 
 
I have considered the idea of a KS to buy something for teardown, but not yet come up with anything with a suitable interestingness-to-cost ratio.

If Mike or Taucher or those who have shown work on the E4 just put up a campaign even with no deliverable, people here know what to do.  I can bet the amount coming shall way exceed a few E4.

[tom66]

I've said it before, I think a kickstarter would work for this.
The investment idea seems too complex, just have many people donate £10 to £20 each and you'll have an E4 in no time...
The E4 can be sold on, and funds donated to a worthy charity, or it can be kept, for future experimentation.

Maybe, but I'd expect either KS to reject or Flir's lawyers to pressure them to do so.
There's also the issue of what the deliverable would be - it could easily be nothing. Maybe something for  Indiegogo then 
 
I have considered the idea of a KS to buy something for teardown, but not yet come up with anything with a suitable interestingness-to-cost ratio.

Ah, but it's not a Flir E4 for hacking... it's for an obscure parametrised analysis of the product with a video camera, serial terminal and scope...

[echen1024]

Hi,

I received my new E4 today, and am already at work hacking! I understand that I need to edit E8.cfg, but I can't for the life of me find that file. I have looked in the folder directly when I hook it up using USB, and have gone into Windows Command prompt and have it show all hidden files, with no luck. Am I missing something really obvious? I can assure you the firmware is 1.19.8.

edit: problem resolved!

[muvideo]

Hello,
i tried searching the tread for the question I'm about to ask,
but I was unable to find :
is it possible to set the transparency of the text and/or
box that reports the temperature values (for example
for "auto min max" cursor mode)?

Also a pointer to the files that set these porperties
or to the relevant posts talking about this is welcome.

Thanks

[mikeselectricstuff]

For the record I have no interest in spending time looking at the new version - I got what I wanted, a 320x240 cam, and am pleased that others have also benefited from it.
I have way too much other stuff to play with to be spending any time on this!

[Pauloven]

Here one of these ebay auctions
eBay auction: #http://cgi.ebay.com/ws/eBayISAPI.dll?ViewItem&item=121284117066&ssPageName=ADME:B:SS:ES:3160
/////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

My camera arrived today!! I'm so excited!!! Hope I manage to upgrade it, im quiteee nonskilled.

The quality of the images out of the box is a bit deceiving. What I liked less i the massssive compresion of the jpg, I assume that the thermal data goes appart attached and is not pixel based, otherwise.... The images feel like a cheap screen capture.

I'll see how it improves. I'm really willing to try the panorama app I've seen in this thread. Looks like the best way to achieve a hi-res thermal image, not so hard to do a 4x and 4y photos to achieve a decent resolution, for facades certaily is the way to go.

When "calibrating" text is shown the image seems to freeze for a sec or so, anoying.

The framerate makes it unusable for night vision FPV on my hexacopter, but for what I've read its non an easy task to get these 60fps the sensor can achieve. May be redirecting the data stream to a phone and process the data in there?? may be that is too much.. whatever. the 320 hack makes this came a super toy!!. THanks!!! I can contribute providing any data from my cam, file backup or watever simply PM or ask here.

[Fraser]

Welcome to the E4+ club 

The image freeze during calibration is unavoidable unless the Non Uniformity Correction (NUC) is disabled. The NUC routine places a shutter over the microbolometer and equalises the output from the pixels to produce a 'flat' image. Sadly Microbalometer arrays drift at unequal rates during use and this necessitates some form of NUC in the design. Some shutterless designs are available but not in the 'budget' Ex series. Whilst the NUC shutter is activated, the camera presents the last captured image which is believed to be more useful than a blank screen, which is the alternative.
The good news is that NUC opertion frequency drops to around once every 2 minutes when the camera has stabilised at operating temperature. In  case you are not aware, the microbolometer in the E4 is actually heated to 30 Degrees C and stabilised at that temperature. Whilst it is warming up you see the Tilda (~) symbol to the left of the measured temperature. This indicated that the camera temperature measurement is not calibrated yet as the required 30 degree C operating temperature has not been reached. A Thermo-electric (peltier) cooler built inside the microbolometer carries out the heating and cooling to maintain accurate sensor temperature.

[pingo]

Does anyone know if it is possible to have the E4 work with FLIR ResearchIR MAX software?

[Fraser]

FLIR's documentation suggests not. The nearest model that can use it is stated as the Exx series.

PDF attached

http://support.flir.com/DsDownload/Assets/T198209_en_51.pdf

You can download a free 30 day trial to test it though 

Other software datasheets are to be found here:

http://support.flir.com/DsDownload/App/DsDownload.aspx?LANG=en&c_id=543&ID=6#21

[DaveWB]

I know someone said they e-mailed Flir and asked if two orders could be combined for rebate but I never saw a response so I called them and they said each purchase must have a separate rebate sent in.

[Rainer]

Hello,

I´m a new owner of a E4 TIC, but i get the new firmware.

Is there any possibility to downgrade or patch the hack? Or can i help with some information about my E4-TIC?
Here some information about my E4-TIC:

Model E4 1.1L
Serial-No. 63914752
Part-No. 63901-0101
SW-Version 1.21.0

10 seconds right-button works

USB-Modes: MSD; UVC;RNDIS; RNDIS & UVC; RNDIS & MSD; UVC & MSD (preset); RNDIS & UVC & MSD
Version-Information:
IRDM 0.0.1.0
POLLUX 0.1.0.0
POLLUX_FPGA 8.1.25.0
camcore T198304-01-63813808
detector *-*-*
mainboard T198283-11-20136016
appkit 1.0.16
confkit E41.1L
osimgkit 16.0.12
prodkit 0
AppCore 22.0.0.1
AppServices 22.0.0.1
Bootloader 16.1.5.0
ResMon 22.0.0.1
WinCE 6.0.0.0
appcore_dll 1.9.0.1
common_dll 1.9.0.7
facet_core 22.0.0.1
facet_ui_qml 22.0.0.1
fvd 16.0.47.0

If you press the right button on any item for 10 Secods, there ist one more menue. But it is empty.

[slpettus]

I know someone said they e-mailed Flir and asked if two orders could be combined for rebate but I never saw a response so I called them and they said each purchase must have a separate rebate sent in.

I ordered two cameras for my company, but were on the same invoice. They allowed me to do the higher rebate. I'm not sure about two separate orders.

[ixfd64]

Someone on another forum is claiming that FLIR Tools can detect "upgraded" E4's, and that FLIR could take legal action against hackers: http://www.nachi.org/forum/showthread.php?t=89207

Thoughts?

[Fraser]

I call B*LLSH*T on that rumour.

I have contacts in the industry who have confirmed that a user changing the configuration of a FLIR E4 is not acting illegally. The fact that the camera is able to be upgraded by a user is FLIR's error and responsibility. This is why I suspeect the new lock-down will be well thought through and effective against many attack vectors.

To act illegaly, a user would need to hack the E4 into a >9fps TIC and send it to another country  without a licence.

It is well known that FLIR Tools 'phones home' and the picture metadata does contain the cameras serial number, so a 320x240 thermal image on a serial number that should be 80x60 would be easy to detect. They can only attempt a countermeasure, not pursue legal action agaiinst the user.

[mikeselectricstuff]

10 seconds right-button works
USB-Modes: MSD; UVC;RNDIS; RNDIS & UVC; RNDIS & MSD; UVC & MSD (preset); RNDIS & UVC & MSD

That's a bit of a surprise...!

[uski]

Hi,

I hacked my e30bx into e60.
However, the e30bx seems to be lacking the Wifi and BT hardware unfortunately.

I was able to increase the max temp from 120 to 650 degrees by activating a "case" in the web server.
Then I did "star calibration" on the new case, and then I rebooted... and voila, 650 degrees max temp !

And unbelievably the camera webpage even lists a calibration date and data for the 650 degrees option, so they calibrate all the temperature ranges at factory and then disable the 650 degrees range if needed, just like the resolution

I would be grateful if anyone with an E40 or better can supply a screenshot of the EEPROM page holding the hardware revisions, part numbers and serial numbers (you can hide those). On my e30bx it says * * * and I'm not sure it's because the HW is not there or because it's just not activated, so I'd like to put the EEPROM values and see if it works.

For the record : I have a camera P/N 490xxxxxx and FW version 2.23.14 (downloaded today from the FLIR website).

[uski]

Is there any possibility to downgrade or patch the hack? Or can i help with some information about my E4-TIC?

Noone have tried yet.
Just try it !!!

Also please tell us what kind of CRC the config files use.

[stefbeer]

Or can i help with some information about my E4-TIC?

As uski already wrote, it would be very interesting to see the file /FlashFS/system/appcore.d/config.d/conf.cfg

But the first thing that pops into my mind: Is it safe (or possible at all) to really activate RNDIS, connect to the camera via FTP and download that file?
I can't stop thinking about some kind of self-destruct-mechanism as soon as you log in via FTP. Or it might be possible that I watch too much action movies...

[Pauloven]

People. THANK YOUUUU!!!!!!!!

I've updated my cam in resolution and in the menu. Converted it from a cool thermometer into an amazing camera!!

The difference is BRUTAL!.  Infinite thanks for sharing the info.

I used the Filezila method, really straightforward. I updated the resolution and menu at the same time.
_____________________________

All newbies (like me) I recommend the Filezila method.
Tha txt of the hack, when says all stuff must go in caps, it  does not reffer to the generated key tu to the first part of the string :   # CRC01
Dont forget to rename the E8.cfg to e8cfg

After setting the usb mode for connecting via FTP don't forget to switch back otherwise no way to see the images and lot of tension like did I screw it up?!?!!?

While doing the backup some files did not get copied, probably this is normal, don't remember reading anything on this. It took my 1-2 hours, rereading everything... better safe than sorry
___________________________
Probably it is documented in teh manual but did not read yet, if you press the photo button continuously it take photos continuously, GREAT feature to stick the cam on a multicopter or plane. ( with a zip or simply duck tape. or for doing timelapses...
___________________________

I'll be posting images in the other thread...

infinite thanks!!!
_____________________________

[Pauloven]

About FLIR modifying our cameras.
Us modifying OUR cameras for OUR usage will hardly be a legal issue. FLIR modifying OUR cameras without permision to do so, that yes would be a serious legal issue for them, specially in the US. If I was flir I would start offering higher res to proffesionals and the E8 like features to mortals, as it is clear that we're ready to pay for that level of tech.

[DaveWB]

Anyone more of a visual learner I uploaded a tutorial:
Resolution hack:

Menu hack:

[mikeselectricstuff]

I can't stop thinking about some kind of self-destruct-mechanism as soon as you log in via FTP. Or it might be possible that I watch too much action movies...

Any form of active "destruct" functionality would be very stupid, as they'd just get a load of pissed off customers returning them as faulty.
 

[Taucher]

Anyone more of a visual learner I uploaded a tutorial:
Resolution hack:
<vid>
Menu hack:
<vid>

Neat ... just a small hint: the resolution hack can be done over RNDIS too, no need for zipping and flirnetinstall then - just drop the e8.conf into the right place by FTP - works just like the .fif version

[tom66]

I think this would be roughly equivalent to a jailbreak of an iPhone -- Apple may explicitly forbid it in the EULA  (no reverse engineering or modifications permitted) but whether that is legally enforceable or not is an entirely different question.

I imagine Flir would easily detect firmware changes like this.

[uski]

I know in the E4 firmware you can make the FLIR logo transparent so that it does not display in the saved JPG pictured.
Does anyone remember where this logo is stored ? I did try to search the forum but I couldn't find it
The reason for asking is that I would like to do the same for my [strike]E30bx[strike] E60.

For the record, I tried replacing the bootlogo.bmp file by another one, but the boot logo did not change. So I suspect the bootlogo on the Exx models is hardcoded somewhere.