Flir E4 Thermal imaging camera teardown

[humdinger13]

I'm new here and would just like to say how impressed I am with you guys, and hope you can answer a few quick questions.

I'm getting ready to purchase one and need to know:

difference between 1.21 and 1.22
I am fairly savvy with computer software/networking, but if something should go wrong, is t possible to totally brick the thing with no recourse?
I am getting a brand new model just in stock today - any chance that hardware changes have been made on these rendering the hack impossible?  Should I ask about a specific model number?

I have read through a ton of this stuff and found answers to all  questions but these.

thanks 4 your help!

[Gallymimus]

I'm new here and would just like to say how impressed I am with you guys, and hope you can answer a few quick questions.

I'm getting ready to purchase one and need to know:

difference between 1.21 and 1.22
I am fairly savvy with computer software/networking, but if something should go wrong, is t possible to totally brick the thing with no recourse?
I am getting a brand new model just in stock today - any chance that hardware changes have been made on these rendering the hack impossible?  Should I ask about a specific model number?

I have read through a ton of this stuff and found answers to all  questions but these.

thanks 4 your help!

I haven't seen a clear indication of differences between 21 and 22 other than a change to FPGA.bin.  It wasn't clear what that DID though.
You can absolutely brick your camera.  Delete or move the wrong files can break it.  You can back up many things and be careful what you are doing.  I would consider the risk to be low to moderate not high... BUT you can absolutely ruin the camera!
It's unlikely that you would have problems hacking the camera unless there were a firmware in the wild past 1.22 with new protection.  I don't think a model number info will help you as the firmware is independent, serial number might help ID which firmware you will get though..

[humdinger13]

Just to be on the safe side, I ended up going with a 1.21.0 unit since it seems like a safer bet.  It's 2 week old stock so there's no chance of any hardware crippling.  I'll let you all know how the upgrade goes.  Thanks so much for the input. 

[Dmt001]

Hi.

Read 90+% of this thread.
Very impressed with the knowledge level of some participants.

I jumped in and ordered an e4. I live and ordered in Canada.
Now I am nervous:
Ordered 2 weeks ago. Was supposed to take 1 week.
Called in today and the new delay is 2 to 3 additionnal weeks.
I can still cancel the order.

Would this be enough time for Flir to seriously lock the e4 to the point where real hw hack is needed to unlock a new version? Or.. Am i getting a bit paranoid ?

Any others seeing those types of delays like the ones a change in production would induce?

Thanks

Dan.

[Gallymimus]

Hi.

Read 90+% of this thread.
Very impressed with the knowledge level of some participants.

I jumped in and ordered an e4. I live and ordered in Canada.
Now I am nervous:
Ordered 2 weeks ago. Was supposed to take 1 week.
Called in today and the new delay is 2 to 3 additionnal weeks.
I can still cancel the order.

Would this be enough time for Flir to seriously lock the e4 to the point where real hw hack is needed to unlock a new version? Or.. Am i getting a bit paranoid ?

Any others seeing those types of delays like the ones a change in production would induce?

Thanks

Dan.

Several vendors here won't have stock til mid April.  That said, you are asking people to pull a guess out of their butts as to what and when FLIR might do something.  It's kind of silly to ask don't you think!

[DaveWB]

Hi.

Read 90+% of this thread.
Very impressed with the knowledge level of some participants.

I jumped in and ordered an e4. I live and ordered in Canada.
Now I am nervous:
Ordered 2 weeks ago. Was supposed to take 1 week.
Called in today and the new delay is 2 to 3 additionnal weeks.
I can still cancel the order.

Would this be enough time for Flir to seriously lock the e4 to the point where real hw hack is needed to unlock a new version? Or.. Am i getting a bit paranoid ?

Any others seeing those types of delays like the ones a change in production would induce?

Thanks

Dan.

I wouldn't be too worried, I would however look around for places that do have them instock if you can and order from them.

[Taucher]

@ the Future

Well, hacking hardware can be like an arms race - as soon as one side takes a step that's too much for the other, the efforts put into development increase (stakes getting higher...).

One can easily iterate the whole race in advance ... up to a point where it would be similar to pay-tv smartcards and game-consoles... just like music and DRM
In consoles (as reported with the X-box) there's even encryption on the internal high speed busses ... and that didn't help much against all sorts of hacking - it just wasted ressources and (for example) when looking at the X-box 1 that money/time would have been much better invested into thermal design in order to prevent massive damage, rework etc.

Something sImilar happened to the music industry - MASSIVE amounts of money were spent on DRM and lobbying - grandmothers and toddlers got sued ...
... until the industry realized (they are still learning it) that selling massive amounts at more reasonable prices is better than overprotecting and selling at a premium - effectively hindering it from beeing sold *G* (economies of scale).

Nobody can tell how the future will look like - but one thing is sure - there's a demand for better image quality (see digital cameras or your phone (yeah, the pocket camera with SMS and speech-capability... and games... and compass.... and and and ... ).

I'd really like see the whole IR-evolution turn into a volume-direction:
Just imaginge the fun one could have with a hobbyist 120x120 sensor module for sub-150$ ...
... how many Arduinos have been sold yet?
... IMHO it's just a matter of time when somebody smart at marketing ( ) realizes the potential

[tjb1]

Hello all,

Got my camera today, got in the first attempt with Filezilla, used the tool to generate the file and added the menubeta.  Now I can not connect at all with Filezilla, I get "no route to host" and "connection refused" every time.  Any ideas?  I've been searching and seen others have had this problem but haven't really found the solution.

[OrBy]

Hello all,

Got my camera today, got in the first attempt with Filezilla, used the tool to generate the file and added the menubeta.  Now I can not connect at all with Filezilla, I get "no route to host" and "connection refused" every time.  Any ideas?  I've been searching and seen others have had this problem but haven't really found the solution.

What have you tried to do to fix it? As you have already said - others have had the error and posted how they addressed it - what have you done?

[ixfd64]

The IP address might have changed. See: https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg412224/#msg412224

[tjb1]

Well I figured it out.

I was able to see the camera in device manager with RNDIS mode activated and it would come up as "FLIR Camera Network Device #7" under "Network Adapters" but I could not connect to the standard 192.168.0.2 or any variation I have seen in this thread.

I did stumble upon someone mentioning the FLIRInstallNet.exe file which shows the IP address of the camera if the driver is working.  This file is located in "Program Files (x86)/FLIR Systems/FLIR Tools/bin".  I attempted to use the given IP address from the tool with no luck in FileZilla or WINSCP.  The IP address was 169.254.216.16, I believe you can also get this number by using command prompt and entering "ipconfig /all", I am not sure though as of now the command prompt gives me 169.254.216.15 and FLIRInstallNet gives me 169.254.216.16 still.

After still failing to connect, I researched some more and read about disabling all network devices/connections so I went back to device manager and disabled everything under "Network Adapters" except the camera, I tried FileZilla again but it still wouldn't work.

I restarted the computer with the camera disconnected, off and battery removed.  When the computer came back up, I put the battery back in and plugged it into the computer while off and turned it.  I then used the FLIRInstallNet program to get the IP address and then was able to use that in FileZilla to connect.  After finishing the changes, I went back into device manager and enabled all of the past disabled devices.




Also, from my experience with doing this.  You can not simply copy the "system" file when doing the MENU hack.  When I did that, I did not get all of the new features.  I had to copy the full FLASHBFS folder over before I got the dialog box that allowed me to overwrite files and now I have all of the color palettes and other features.

[DaveWB]

Also, from my experience with doing this.  You can not simply copy the "system" file when doing the MENU hack.  When I did that, I did not get all of the new features.  I had to copy the full FLASHBFS folder over before I got the dialog box that allowed me to overwrite files and now I have all of the color palettes and other features.

Are you copying the system file into the FlashBFS folder to overwrite the existing FlashBFS folder to overwrite the existing system folder? You may have copied the system folder over the old system folder which in reality puts the system folder you are transferring into a subfolder within the original system folder instead of overwriting it.

[tjb1]

Also, from my experience with doing this.  You can not simply copy the "system" file when doing the MENU hack.  When I did that, I did not get all of the new features.  I had to copy the full FLASHBFS folder over before I got the dialog box that allowed me to overwrite files and now I have all of the color palettes and other features.

Are you copying the system file into the FlashBFS folder to overwrite the existing FlashBFS folder to overwrite the existing system folder? You may have copied the system folder over the old system folder which in reality puts the system folder you are transferring into a subfolder within the original system folder instead of overwriting it.

I copied the System folder into FLASHBFS like it said and I did not get everything.  Watching the video, the screen did not come up asking me if I wanted to overwrite or anything so I copied the entire FLASHBFS folder into the level above FLASHBFS and it worked.

[Mutha101]

Just wanted to say thanks to all who made this possible.

Just turned the camera back on and whoa!

Excellent stuff 

[Onion]

I followed ds's instructions to hack my model  E4 1.1L , software:1.22.0 , but MSX is not working now. In fact, the digital camera is not working fuctioning properly. There is no color digital camera file saved when saving a pic in thermal mode. When I take a pic in color cam mode (I can see a full color preview) I get a pop-up that says Application error- Application appcore.exe encountered a serious error and must be shut down.

I applied the menu hack but have no crosshairs, no MSX, do have most of the extended color palletes but not the ones involving color camera functions, no zoom and others missing that are showing on successfully hacked cams.

I made a backup of my conf.cfc file , but forgot to back up my original Flash.BFS file. Does anyone have a copy that I can use to regain the factory settings (at least for the menus)? I'd like to try the mod again, but at this point the camera is not very useful.

Also, the info on thermal pics I take states only 1 parameter: Digital resolution          320x240  ! No other info for the thermal image!!?

No problem en/decrypting conf.cfc. 

I read most of everything here and have not found any hints or ideas toward what might be my problem.

[heavybarrel]

Onion,
If you could give something a try that i have been curious about! Since you don't have the original file, i have been wondering
if it is possible to run the firmware update from flir. Your cam already had 1.22 on it but if there is a corrupt or missing file the update may repair it? If that works there are quite a few people that have had the same issue. It may all be for not if the firmware update just looks at the current version info and stops there but its worth a shot!

[heavybarrel]

I have had absolutely no issues with my camera. I am just curious if running flirs update will fix a non working camera.
Being that mine is tip top i have not run any updates. Sadly the 1.19.8 firmware was taken down from flirs site before i was able to grab it. If i decide to do any messing around and it goes wrong i do have the 1.21 and 1.22 firmwares. Does anyone have a zip of 1.19.8 they could link? My unit came with 1.19.8 and patching it was almost as easy as powering it up!

[stefbeer]

Sadly the 1.19.8 firmware was taken down from flirs site before i was able to grab it. [...] Does anyone have a zip of 1.19.8 they could link?

As far as I know the 1.19.8 firmware has never been available for download at FLIR's site. When 1.19.8 was the latest firmware, you could only download the 1.18.7 from their site. And then the 1.21.0 was published. And now the 1.22.0 .
But a few (hundred) pages back Taucher helped somebody with a bricked TIC with firmware 1.19.8 to unbrick it and they used the 1.18.7 firmware. So at that time a downgrade was possible.
User fp tried to do a firmware downgrade with his 1.21.0 TIC to 1.18.7 (I think) and he bricked his device. So with the newer firmwares a downgrade isn't possible anymore.

[tjb1]

@ All newbies: Is it so hard to copy files from one directory to another?
It is as same as on computer from drive c: to drive d:.
For the E4 hack of 1.21/1.22 firmware it is so easy with the cfc_generator.
But you have to rename the resulting file conf_new.cfc to e8.cfc and then to copy it to the FlashFS\system\appcore.d\config.d\ subdir.
There is nothing to delete, just copy into this directory besides the conf.cfc.
The files for the menu hack it's the same, just copy to the same directories.
The directory 'presets.d' with its files are new in FlashBFS\system\ui.d\

What you just said for the main hack is completely different from about every thing else in the thread.  Naming it to e8.cfc would not overwrite the old conf.cfc and even though I believe I read it will grab the first file alphabetically (may be wrong) that file is further down anyway.

With the menu hack, I did exactly as the video and many people said.  Drop system onto FlashBFS, not into the folder itself along side the old system and it should have overwritten everything but I only got 2-3 color palettes and 1 pip and none of the scale options or extra menus like the USB one or the condensation items.  Those did not show up until I took the whole FLASHBFS folder and dragged it onto the directory above FLASHBFS and I think this is an issue related to FileZilla because when doing it the second time it asked what I wanted to do with the files, the first time using system folder it just did whatever.

[Gallymimus]

With the menu hack, I did exactly as the video and many people said.  Drop system onto FlashBFS, not into the folder itself along side the old system and it should have overwritten everything but I only got 2-3 color palettes and 1 pip and none of the scale options or extra menus like the USB one or the condensation items.  Those did not show up until I took the whole FLASHBFS folder and dragged it onto the directory above FLASHBFS and I think this is an issue related to FileZilla because when doing it the second time it asked what I wanted to do with the files, the first time using system folder it just did whatever.

It sounds pretty clear that you simply copied the FlashBFS folder to the wrong location on the camera.  It's probably not an issue with filezilla.  No offense but you didn't understand where you were putting the files when you were doing the copy.  Are you able to confirm that you have extra files in the wrong place on your camera?

[tjb1]

With the menu hack, I did exactly as the video and many people said.  Drop system onto FlashBFS, not into the folder itself along side the old system and it should have overwritten everything but I only got 2-3 color palettes and 1 pip and none of the scale options or extra menus like the USB one or the condensation items.  Those did not show up until I took the whole FLASHBFS folder and dragged it onto the directory above FLASHBFS and I think this is an issue related to FileZilla because when doing it the second time it asked what I wanted to do with the files, the first time using system folder it just did whatever.

It sounds pretty clear that you simply copied the FlashBFS folder to the wrong location on the camera.  It's probably not an issue with filezilla.  No offense but you didn't understand where you were putting the files when you were doing the copy.  Are you able to confirm that you have extra files in the wrong place on your camera?

No...I copied FlashBFS into the folder above it which I believe is just "/" which would cause it overwrite the entire FlashBFS folder.  The first time I put "system" onto FlashBFS instead of placing it inside of FlashBFS.  Yes, I did understand where I was putting the files and how to do it but something did not happen correctly when placing system on FlashBFS and was not corrected until I did it with the FlashBFS folder.

[heavybarrel]

As far as I know the 1.19.8 firmware has never been available for download at FLIR's site. When 1.19.8 was the latest firmware, you could only download the 1.18.7 from their site. And then the 1.21.0 was published. And now the 1.22.0 .
But a few (hundred) pages back Taucher helped somebody with a bricked TIC with firmware 1.19.8 to unbrick it and they used the 1.18.7 firmware. So at that time a downgrade was possible.
User fp tried to do a firmware downgrade with his 1.21.0 TIC to 1.18.7 (I think) and he bricked his device. So with the newer firmwares a downgrade isn't possible anymore.
[/quote]

Thanks Stefbeer! That's good info! I do have a copy of 1.18.7, i actually have read every page here and not surprisingly don't
remember the info about the downgrade. Oh boy, time to re-read this monster!! Taucher has been extremely helpful with resolving problems and he deserves some thanks! Regarding the 1.19.8 firmware, you could be correct, maybe it was never available. I seem to remember (again a few hundred pages back)( Aurora i believe) had some links to all the available firmwares. I thought 1.19.8 was linked but when i looked at it the link was dead. That's when i assumed it was "taken down".
If there is a copy of the 1.19.8 out there i would like to make an attempt at reloading it to my camera then re-patching. My TIC is in perfect working order so it may not be an accurate test but if it does get "restored" to factory that could eliminate some of the "please help!" posts. I make absolutely no claims of being an expert on this stuff so i may be barking up the wrong tree.

Edit: The above quote didn't show up right, proving its real easy to mess things up! https://www.eevblog.com/forum/Smileys/default/smiley_laughing.gif

[Gallymimus]

No...I copied FlashBFS into the folder above it which I believe is just "/" which would cause it overwrite the entire FlashBFS folder.  The first time I put "system" onto FlashBFS instead of placing it inside of FlashBFS.  Yes, I did understand where I was putting the files and how to do it but something did not happen correctly when placing system on FlashBFS and was not corrected until I did it with the FlashBFS folder.

Hehe, okay, well you either did something wrong, OR you found a major bug in filezilla and should file a bug report with filezilla.org.

anyway I'm glad you got it working.

[tjb1]

With the menu hack, I did exactly as the video and many people said.  Drop system onto FlashBFS, not into the folder itself along side the old system and it should have overwritten everything but I only got 2-3 color palettes and 1 pip and none of the scale options or extra menus like the USB one or the condensation items.  Those did not show up until I took the whole FLASHBFS folder and dragged it onto the directory above FLASHBFS and I think this is an issue related to FileZilla because when doing it the second time it asked what I wanted to do with the files, the first time using system folder it just did whatever.

It sounds pretty clear that you simply copied the FlashBFS folder to the wrong location on the camera.  It's probably not an issue with filezilla.  No offense but you didn't understand where you were putting the files when you were doing the copy.  Are you able to confirm that you have extra files in the wrong place on your camera?

No...I copied FlashBFS into the folder above it which I believe is just "/" which would cause it overwrite the entire FlashBFS folder.  The first time I put "system" onto FlashBFS instead of placing it inside of FlashBFS.  Yes, I did understand where I was putting the files and how to do it but something did not happen correctly when placing system on FlashBFS and was not corrected until I did it with the FlashBFS folder.

Post a screenshot here from filezilla with the entire directory tree. We will see what's wrong.

Already been fixed.

[Onion]

Onion,
If you could give something a try that i have been curious about! Since you don't have the original file, i have been wondering
if it is possible to run the firmware update from flir. Your cam already had 1.22 on it but if there is a corrupt or missing file the update may repair it? If that works there are quite a few people that have had the same issue. It may all be for not if the firmware update just looks at the current version info and stops there but its worth a shot!

Thanks heavybarrel for the suggestion. I installed the update and no, it did not stop because my current version info. It did install/change a bit of files.

Now I have a stock E4 without the digital camera recording pics and no MSX! No crosshair/temp measurements,  Hmmmmmm!!? The update did not help.
fyi - I used the Addmenu-beta3 files
What next?