Flir E4 Thermal imaging camera teardown

[Rainer]

if this is happen, the TIC has a problem with the config.cfc. Pick on of the other cfc-files or your backup and make the hack for a second time. Attention: The Beta you have to install in the FlashBFS and the hack you have to install in the FlashFS.

@freak_ge: With tomas123 i had tested the old appcore-Exe on my new 1.1L-HW. And i had tested the prodapp-Exe from the 1.19.8. Both Executables are working. So i think, it is not completly impossible to downgrade. And the downgraded TIC of "fp" was not fully bricked. The bootloader was working, as i remember his last posts.

[heavybarrel]

@Onion
Sorry that didn't help! Now i know that the updates don't replace all of the files on the cam. Rainer mentioned grabbing one of the other config.cfc files. They are on your cam, there isn't just the one you messed with. I don't remember the page number but a little way back in this thread that is talked about. It will tell you where to find one that will work. Hope you get it working! It will take some tinkering but you'll get it!

[humdinger13]

if this is happen, the TIC has a problem with the config.cfc. Pick on of the other cfc-files or your backup and make the hack for a second time. Attention: The Beta you have to install in the FlashBFS and the hack you have to install in the FlashFS.

@freak_ge: With tomas123 i had tested the old appcore-Exe on my new 1.1L-HW. And i had tested the prodapp-Exe from the 1.19.8. Both Executables are working. So i think, it is not completly impossible to downgrade. And the downgraded TIC of "fp" was not fully bricked. The bootloader was working, as i remember his last posts.

Hi Rainer, wie gehts?
Yes of course, the appcore.exe from 1.19 is working on 1.22.
Since 1.21 the webaccess (192.168.0.2) is not completely. It is no more possible to change the EEPROM ('E4' to 'E8'), and service mode is no longer available.
But with old appcore.exe running as appcore1.exe the EEPROM access and the service mode working very well.
I have already the 4th E4 cracked, now the firmware 1:22. More and more friends be convinced by me and the superior performance of the E8+. I am then getting the patcher.

I am going to be getting a 1.21 1.1L on Thursday.  Are you saying that service mode will be unavailable, and what exactly does that mean?  I don't recall service mode even being discussed.  Would upgrading to 1.22 be a wise choice before doing the hacks?  Thanks.

[kanzas19]

Has anyone tried to replace the battery in your Ex?
In the middle of the cell li-ion 18650. It is also about 2 "little shit"  who can not "see" the newly listed batteries.
Probably in soft are also some security.
  Let's do something about it, if someone tried?

[Gallymimus]

Has anyone tried to replace the battery in your Ex?
In the middle of the cell li-ion 18650. It is also about 2 "little shit"  who can not "see" the newly listed batteries.
Probably in soft are also some security.
  Let's do something about it, if someone tried?

What?  I don't understand what you are saying.

I think it is unlikely that there is security on a 3 terminal Li-Ion battery, 3rd terminal is usually thermistor.

[humdinger13]

if this is happen, the TIC has a problem with the config.cfc. Pick on of the other cfc-files or your backup and make the hack for a second time. Attention: The Beta you have to install in the FlashBFS and the hack you have to install in the FlashFS.

@freak_ge: With tomas123 i had tested the old appcore-Exe on my new 1.1L-HW. And i had tested the prodapp-Exe from the 1.19.8. Both Executables are working. So i think, it is not completly impossible to downgrade. And the downgraded TIC of "fp" was not fully bricked. The bootloader was working, as i remember his last posts.

Hi Rainer, wie gehts?
Yes of course, the appcore.exe from 1.19 is working on 1.22.
Since 1.21 the webaccess (192.168.0.2) is not completely. It is no more possible to change the EEPROM ('E4' to 'E8'), and service mode is no longer available.
But with old appcore.exe running as appcore1.exe the EEPROM access and the service mode working very well.
I have already the 4th E4 cracked, now the firmware 1:22. More and more friends be convinced by me and the superior performance of the E8+. I am then getting the patcher.

I am going to be getting a 1.21 1.1L on Thursday.  Are you saying that service mode will be unavailable, and what exactly does that mean?  I don't recall service mode even being discussed.  Would upgrading to 1.22 be a wise choice before doing the hacks?  Thanks.

It makes no difference whether 1.21 or 1.22.
Look at attached files, this is the service mode!
But beware, you can make a lot of broken.

OK, I remember seeing that a few times, but don't recollect anyone mentioning that it is unavailable as of 1.21 +.  This is troubling.  Is it possible to edit these menu item parameters via config files?

[Fraser]

@kansas19

The Ex battery is a standard 'dumb' design with a 10k thermistor connected to the 3rd terminal. There is no 'intelligence' in the battery. At least one member of this forum has fitted a higher capacity Li-Ion cell into teh battery case without issues.

[humdinger13]

OK, I remember seeing that a few times, but don't recollect anyone mentioning that it is unavailable as of 1.21 +.  This is troubling.  Is it possible to edit these menu item parameters via config files?

Service mode is needed the webfiles (FlashBFS\system\web\) from a 1.19 camera. In a 1.22 camera I had seen these files are missing.

So will copying files from a 1.19 or 1.18 fix it? 

[Rainer]

OK, I remember seeing that a few times, but don't recollect anyone mentioning that it is unavailable as of 1.21 +.  This is troubling.  Is it possible to edit these menu item parameters via config files?

Service mode is needed the webfiles (FlashBFS\system\web\) from a 1.19 camera. In a 1.22 camera I had seen these files are missing.

So will copying files from a 1.19 or 1.18 fix it?

You need also the prodapp.exe and the dll.

[Onion]

if this is happen, the TIC has a problem with the config.cfc. Pick on of the other cfc-files or your backup and make the hack for a second time. Attention: The Beta you have to install in the FlashBFS and the hack you have to install in the FlashFS.

@freak_ge: With tomas123 i had tested the old appcore-Exe on my new 1.1L-HW. And i had tested the prodapp-Exe from the 1.19.8. Both Executables are working. So i think, it is not completly impossible to downgrade. And the downgraded TIC of "fp" was not fully bricked. The bootloader was working, as i remember his last posts.

Thanks for the replies guys! I successfully modded my 1.1L 1.22.0 ! I was able to restore to factory settings after pasting the factory conf.cfc. After I tried the mod again, success!
This will be an indispensable tool  in my construction business!
Thank you all for the hard work and effort put into this project!!!

[heavybarrel]

Congrats Onion! Told you you would get it! Just for the record please post the file path to the conf file that you used!

[humdinger13]

if this is happen, the TIC has a problem with the config.cfc. Pick on of the other cfc-files or your backup and make the hack for a second time. Attention: The Beta you have to install in the FlashBFS and the hack you have to install in the FlashFS.

@freak_ge: With tomas123 i had tested the old appcore-Exe on my new 1.1L-HW. And i had tested the prodapp-Exe from the 1.19.8. Both Executables are working. So i think, it is not completly impossible to downgrade. And the downgraded TIC of "fp" was not fully bricked. The bootloader was working, as i remember his last posts.

Thanks for the replies guys! I successfully modded my 1.1L 1.22.0 ! I was able to restore to factory settings after pasting the factory conf.cfc. After I tried the mod again, success!
This will be an indispensable tool  in my construction business!
Thank you all for the hard work and effort put into this project!!!

Are you able to enter and use service mode?

[kanzas19]

@Gallymimus & Aurora


Thermistor?
I'm afraid that you may not be right in this case.
When I connect a new battery, the display of the camera is the empty battery symbol crossed (battery broken). Approx. 1 - 2 sec. and the camera turns off.
In the picture two little sh.t in battery

[scientist]

So, has the 1.21/1.22 firmware been defeated?

If so, high five! Suck it, FLIR!

If not... 

[marculito]

So, has the 1.21/1.22 firmware been defeated?

If so, high five! Suck it, FLIR!

If not... 

Yeah I have 1.21 and mine has been "hacked". Works great! Especially with all the new menus

[Fisher]

Has anyone received recently the free gift for the E4 purchase?
I`ve sent my request early in March, they requested me the invoice around the 15th of March,and since then I have no feedback.

[humdinger13]

So, has the 1.21/1.22 firmware been defeated?

If so, high five! Suck it, FLIR!

If not... 

Yeah I have 1.21 and mine has been "hacked". Works great! Especially with all the new menus

I'm glad to hear that.  So service mode is also completely functional as well?  I can't seem to get an answer on this.  Thanks.

[tomas123]

@Gallymimus & Aurora


Thermistor?
I'm afraid that you may not be right in this case.
When I connect a new battery, the display of the camera is the empty battery symbol crossed (battery broken). Approx. 1 - 2 sec. and the camera turns off.
In the picture two little sh.t in battery

see discussion here
https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg385379/#msg385379
https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg385395/#msg385395

[RAWebb]

@ Fisher

Yes, the turn-around time was only one week from the time I mailed the receipts until it arrived via UPS. I went with the laser rangefinder, since I already had a cheap but good enough borescope. Good enough to find missing cat toys under the refrigerator, at least.

I included a copy of everything that seemed relevant: a printout of the email confirmation from the vendor, the invoice from the web page, and the packing list from the shipment of the camera. The order number tracked all the way through all three pieces of paper, so they could see that I ordered it, paid for it, and received it plus verify that it was a genuine UPS tracking number.

[mikeselectricstuff]

@Gallymimus & Aurora


Thermistor?
I'm afraid that you may not be right in this case.
When I connect a new battery, the display of the camera is the empty battery symbol crossed (battery broken). Approx. 1 - 2 sec. and the camera turns off.
In the picture two little sh.t in battery

That pic shows 2 FETs and a control chip - standard lithium protection circuit.
There is a battery management chip on the main board, which does gas-gauging to estimate battery state - it probably does some reality checks on the voltage and thermistor value. 
 

[humdinger13]

So, has the 1.21/1.22 firmware been defeated?

If so, high five! Suck it, FLIR!

If not... 

Yeah I have 1.21 and mine has been "hacked". Works great! Especially with all the new menus

I'm glad to hear that.  So service mode is also completely functional as well?  I can't seem to get an answer on this.  Thanks.

If you have a 1.21, then you can test the service mode and give us an answer on this question.
I hope, you have had a backup of your camera before hacking. Plz. check the subdir FlashBFS\system\web\
How many files are in it?
Or go in RNDIS mode, connect to PC and call 192.168.0.2 in browser. If web interface shown, klick on service mode.

I do not have the camera yet.  It is on the way.  I purchased it because there were no indications that I could see that said anything about a problem after the hack was announced.  So far you're the only person who has mentioned a problem with service mode as far as I can tell, which is why I am asking others to tell me their experiences with regard to this.  I read through everything here, and your revelation comes as a shock and huge disappointment to me and I don't understand why others haven't brought this up.   I would have expected some notice about this in the information thread as well. 

[Rainer]

@ freak_ge: i have a 1.21-TIC. The web/service-folder ist empy(or a couple of files and empty folders in it, but not the "index.asp") So there is no web-based service mode.

In the battery are two serial FETs, one in charge and one in discharge-direction. This is a standard application of the Li-Ion-protection-ics. And a little 6-pin-SOT23 "Battery protection IC" to control the fets. Most of these protection-IC´s have two pins for measure voltage of the cell, two pins as output for switching the fets and one pin for measure the current (with the Rdson as shunt). The sixth pin is sometimes for special purposes and sometimes sometimes not in use(like the microchip units). These chips are important for the safety of the battery, but not for any application in the  TIC. When the TIC switched of, after modification of the battery, it might possible, that the protection ic switched of the discharge-Fet.   

[humdinger13]

So, has the 1.21/1.22 firmware been defeated?

If so, high five! Suck it, FLIR!

If not... 

Unless there is some workaround, I am going to be very disappointed

Yeah I have 1.21 and mine has been "hacked". Works great! Especially with all the new menus

I'm glad to hear that.  So service mode is also completely functional as well?  I can't seem to get an answer on this.  Thanks.

If you have a 1.21, then you can test the service mode and give us an answer on this question.
I hope, you have had a backup of your camera before hacking. Plz. check the subdir FlashBFS\system\web\
How many files are in it?
Or go in RNDIS mode, connect to PC and call 192.168.0.2 in browser. If web interface shown, klick on service mode.

I do not have the camera yet.  It is on the way.  I purchased it because there were no indications that I could see that said anything about a problem after the hack was announced.  So far you're the only person who has mentioned a problem with service mode as far as I can tell, which is why I am asking others to tell me their experiences with regard to this.  I read through everything here, and your revelation comes as a shock and huge disappointment to me and I don't understand why others haven't brought this up.   I would have expected some notice about this in the information thread as well. 

[stefbeer]

[...] So far you're the only person who has mentioned a problem with service mode as far as I can tell, which is why I am asking others to tell me their experiences with regard to this.  I read through everything here, and your revelation comes as a shock and huge disappointment to me and I don't understand why others haven't brought this up.   I would have expected some notice about this in the information thread as well. 

It has been stated here and here. And most certainly a few other times.
What exactly is "a shock" and "huge disappointment" about a missing service mode that has been hardly used anyway? It's still hackable. Is an E8+ for the price of an E4 worth nothing?
I really don't see an issue...

[humdinger13]

So, has the 1.21/1.22 firmware been defeated?

If so, high five! Suck it, FLIR!

If not... 

Unless there is some workaround, I am going to be very disappointed

Yeah I have 1.21 and mine has been "hacked". Works great! Especially with all the new menus

I'm glad to hear that.  So service mode is also completely functional as well?  I can't seem to get an answer on this.  Thanks.

If you have a 1.21, then you can test the service mode and give us an answer on this question.
I hope, you have had a backup of your camera before hacking. Plz. check the subdir FlashBFS\system\web\
How many files are in it?
Or go in RNDIS mode, connect to PC and call 192.168.0.2 in browser. If web interface shown, klick on service mode.

I do not have the camera yet.  It is on the way.  I purchased it because there were no indications that I could see that said anything about a problem after the hack was announced.  So far you're the only person who has mentioned a problem with service mode as far as I can tell, which is why I am asking others to tell me their experiences with regard to this.  I read through everything here, and your revelation comes as a shock and huge disappointment to me and I don't understand why others haven't brought this up.   I would have expected some notice about this in the information thread as well. 

Would you tell us something?

Tell you what?