Flir E4 Thermal imaging camera teardown

[mikeselectricstuff]

Has anyone found a way to change the configuration files to allow for tracking of more than 1 hot or 1 cold spot?  Ideally tracking all hot spots in the entire frame...

-will

How would you decide what constitutes hot/cold?
Why would you want to do this?

The read above/blue below modes allow highlighting of over/under temp areas

[clavo]

For example:  Tracking 4 hogs for hunting and having them framed so you can clearly see the object without obscuring it.  A novelty yes, but if it can track 2 spots (hot and cold) and draw a target over them it should be able to draw a box around X amount of objects above a certain temperature right?

-will

[mikeselectricstuff]

For example:  Tracking 4 hogs for hunting and having them framed so you can clearly see the object without obscuring it.  A novelty yes, but if it can track 2 spots (hot and cold) and draw a target over them it should be able to draw a box around X amount of objects above a certain temperature right?

-will

Why draw a box? The red above palette will highlight hot objects perfectly well
 

[Chuck]

Hi Gents,

I just received my new E4 and was planning to hack it. But in hidden menu I can’t change USB mode to RNDIS. I’m trying but the setting is not changing from default. Is there any workaround to change it some different way? Thnx.

[chriseparent]

like a fool, I grabbed an E4 2.3.0 firmware on eBay.   It seems there really is no hack for it?  what a bummer.  an expensive bummer.....

[mikeselectricstuff]

like a fool, I grabbed an E4 2.3.0 firmware on eBay.   It seems there really is no hack for it?  what a bummer.  an expensive bummer.....

I don't think anyone has given it a serious look. It has been reported that a previously 1.22 unit which was upgraded when it was returned was still hackable -  I don't know if anyone has tried the same method  on a factory 2.3 unit. Could be worth investigating....

[clavo]

Just to be able to?  The FLIR automotive cameras choose to draw a box around pedestrians and animals instead of just blurring it with a different color for a reason.  It makes it easier to identify the object.  Being able to change the hot/cold target box to be full screen would be helpful to some as well.  Just because it's not something you personally find useful doesn't mean others wouldn't like the feature.

-will

For example:  Tracking 4 hogs for hunting and having them framed so you can clearly see the object without obscuring it.  A novelty yes, but if it can track 2 spots (hot and cold) and draw a target over them it should be able to draw a box around X amount of objects above a certain temperature right?

-will

Why draw a box? The red above palette will highlight hot objects perfectly well

[chriseparent]

Well,  ive been trying all day with no luck.   Got as far as installing FIF file with zero results.   How does one save a file with \ in the name anyhow?

[chriseparent]

like a fool, I grabbed an E4 2.3.0 firmware on eBay.   It seems there really is no hack for it?  what a bummer.  an expensive bummer.....

I don't think anyone has given it a serious look. It has been reported that a previously 1.22 unit which was upgraded when it was returned was still hackable -  I don't know if anyone has tried the same method  on a factory 2.3 unit. Could be worth investigating....

Ahh... Forgot to quote you

[jpcjguy]

Received mine yesterday new - 959 shipped - last 4 of serial was 1757 - came with 1.22.0
 
Time for the upgrade!!!

[MarkIR]

I'm an old house owner that likes new toys and has an ongoing, unsolved water leak ($6k to rebuild a chimney and I just discovered that I still have a problem) .  I also pay 1/2 to 2/3 the price of an E4 every month in energy bills.  I was considering a rental from Home Depot, but am now considering the E4.  I looked at the Flir One as well, but the E4 (hacked) is a lot more interesting as a tool I can use on a regular basis.

Is there still a reliable place to find an E4 that can be modified?  I'm still going through threads to learn more and see if there are any recommended vendors.

Thanks,
Mark

Edit: Found one (Thanks)

[blincoln]

I wanted to post a long-overdue thank-you to Mike and everyone else involved in making this possible. I'd wanted a thermal imager for literally 20 years (ever since I saw Predator), and you made it affordable to get ahold of one with decent resolution. I've been using mine since March, and it's been outstanding.

I also have a question - maybe this is overkill, but has anyone tried downgrading the firmware by directly connecting to the pins on the flash memory in the device? My understanding is that it's not possible to downgrade the "normal" way, but unless there are physical changes to the hardware, shouldn't it be possible to copy a raw firmware image from e.g. a 1.22 device to a 2.x device by using raw flash memory read/write hardware connected directly to the chip?

[PA0PBZ]

The problem with that is that you lose your calibration, because the old firmware will not be able to read the encrypted files.

[mikeselectricstuff]

The problem with that is that you lose your calibration, because the old firmware will not be able to read the encrypted files.

Do we know that the cal data is encrypted and/or incompatible with earlier firmware ? Would be easy to test if we can get a new cal file.
May also be interesting to try an old cal file on new FW as that may have been what made it work for that upgraded unit

[chriseparent]

If possible could someone please list the steps necessary to hack a 2.3.0 e4?  Thank you in advance

[mikeselectricstuff]

If possible could someone please list the steps necessary to hack a 2.3.0 e4?  Thank you in advance

1) Figure out encryption method
2) Write software to create suitably encrypted config file
3) Enjoy!

[ixfd64]

I believe the latest version uses 1,024-bit RSA encryption, which can't be broken with current hardware. However, firmware with public-key encryption can be hacked via other means:

Just a short comment regarding hacking a public/private crypto system:

-> find public key stored in device
-> replace public key with own one
-> re-sign all signed stuff
-> have fun

In case the key is hardwired somewhere, then just patch the comparison routine(s).
-> In short: Flir is just setting up a challenge instead of ensuring that their customers get maximum satisfaction.

[tsmith35]

I believe the latest version uses 1,024-bit RSA encryption, which can't be broken with current hardware.

If you have any connections at the NSA, you're in...

[mikeselectricstuff]

I believe the latest version uses 1,024-bit RSA encryption, which can't be broken with current hardware.

If you have any connections at the NSA, you're in...

At least we have a very good idea if what most of the plaintext is...

I think the best avenues, in order,  would be to figure out how to make it think it's an old unit that had been updated, downgrade to  older firmware, or make it load a hacked firmware image to bypass checks.
However as there are still a few 1.22 units out there I can't see anyone having a serious go at this for a while. 

 

[Fraser]

Let us not forget that firmware 2.3 sits on a 'new' hardware revision platform. It has yet to be established how the new hardware platform differs from the previous revision. If I were FLIR I would have installed hardware based countermeasures to hacking but then we do not know how much effort FLIR put into this.

As I have said before.....if this thread starts detailing hacking of the 2.3 Firmware expect Dave to get a take down notice pretty damned quick 

Maybe move any such discussion to a new 'sacrificial' thread ?

[mikeselectricstuff]

As I have said before.....if this thread starts detailing hacking of the 2.3 Firmware expect Dave to get a take down notice pretty damned quick 

Why ? On what basis?
There is nothing about the new FW that makes it any more or less legal to play with than the older ones.
All we know for sure about what Flir have done so far is they've had a few ebay listings taken down for possibly dubious claims of misrepresentation, and even that is patchy and they have since been re-appearing (and sometimes disappearing) on a regular basis.

[Roboss]

I agree, details on how to hack 2.3 would be no different than the ones contained in this thread and others about how to hack 1.22

Just because the encryption method has changed?

[Fraser]

No worries, but don't ever complain that you were not warned 

[chriseparent]

Watching this thread ever so closely.... Thank you folks

[chriseparent]

Just for a laugh i wrote FLIR and asked for instructions on how to upgrade the E4 to an E8.  I'll be sure to let you know exactly what
 their presumably hilarious refusal is.