Flir E4 Thermal imaging camera teardown

[mikeselectricstuff]

There's an opportunity for a new company to start selling official 320x240 TIC for <$1000

Assuming they could buy sensors at the right price, which probably means high volumes.

The only possible exception to this is if the lens or sensor in the E4 was bin'ed as reject, which would otherwise be thrown away.

The service info on mine showed no dead pixels - it does appear to have the ability map out (mask) dead pixels.
Unless they have significant yield issues, it may well be more hassle than it's worth to to sort out useable rejects from non-useable ones.

[IanB]

I may be totally wrong as you know more about the firmware than me, but I have not heard of this noise insertion technique in a TIC before. Bit padding, yes, but not noise insertion.

Maybe I'm preaching to the choir, but noise addition and oversampling is a standard technique for getting more resolution out of a low res sensor (by resolution, I mean more bits per pixel, not more pixels). Essentially you are oversampling the A/D converter. Instead of taking one sample, you take many samples and average them. By itself this may not help much due to sampling bias, but if you add random noise to the input signal and then take multiple samples you can get more bits per reading at the cost of longer time to obtain each reading. By averaging over many samples you not only can get higher resolution (e.g. 9-12 bits from an 8 bit sensor), but you also can reduce noise by averaging it out.

(The way this works is as follows: statistically speaking, an analog value of 37.4/255 on an 8 bit A/D is likely to produce a reading of 37 most of the time. But if you add some random noise and sample multiple times, you will get a reading of 37 about 60% of the time and a reading of 38 about 40% of the time. By averaging over several readings, you will obtain a better estimate of 37.4 rather than 37 or 38.)

[Richard Wad]

Dave, willing to do some tests on the E8 for us?  I can see you watching.

Please - someone find the magic keypresses so Dave can dump the eeprom and config files without opening it!

Hello Mike
First post here, thought I'd say a huge thanks for your efforts on this. I happen to have an E4 also.

Curious, how many possible key presses do you think this could entail? If we include the power on button, there are 8 buttons. If flir chose to make this more difficult, could they have perhaps chosen 2 buttons  to be depressed at the same time?

I can work on this if it exists, how will I know if/when the dump has occurred?

[mikeselectricstuff]

Dave, willing to do some tests on the E8 for us?  I can see you watching.

Please - someone find the magic keypresses so Dave can dump the eeprom and config files without opening it!

Hello Mike
First post here, thought I'd say a huge thanks for your efforts on this. I happen to have an E4 also.

Curious, how many possible key presses do you think this could entail? If we include the power on button, there are 8 buttons. If flir chose to make this more difficult, could they have perhaps chosen 2 buttons  to be depressed at the same time?

I can work on this if it exists, how will I know if/when the dump has occurred?

It appears that the hidden menu is are "after" the info (model/ersion/serial no) in the settings->camera information menu ( all entries appear the same). Current best guess is that some key combination at startup (presses or keys held) will enable the additional menu, probably visible by a right-arrow or enter on these menu items.
The i series uses 2 keys pressed together at some point after startup, one of which was an arrow key. My guess would be this is detected after the bootloader - first FLIR screen before export message.
And probably only on a cold boot (battery insert)
Stay tuned to this thread for info - code is disassembled - I'm not working on it but others are.

[Richard Wad]

Hi Mike
You're up late. Or early!
OK well I have some time on my hands so I will try all the key combos I can come up with and let you know.
Will it dump to its internal storage the data you are seeking?

[Psi]

The files he wants to dump on an E8 unit isnt an automatic thing. It requires enabling RNDIS and running some commands.

Finding the key combo to get the service menu means this data can be dumped out without taking the unit apart. (Since Dave doesn't want to do that to an E8 on loan.)

[Richard Wad]

Thanks
Is that on the camera side through the serial connection, enabling RNDIS?

[mikeselectricstuff]

Just had this message  re. i7
The secret key combo for the i7 is to bring up the menu and hold down the gallery key for 5 seconds. The code for it is very visible in gui.exe as it uses a timer and is written in .Net (so it's super easy to disassemble). Perhaps if you disassembled your gui.exe it might be in there?

Also, no special boot conditions are required to enter the service menu. Nor does the key combo need to be pressed during startup.

I got into my i7 some time ago (I was also too nervous to release it ), but I am yet to figure out the "CRC" algorithms on the config files. I think this is the key to modding it, and I think it seems to be based on some sort of RIPEMD160 and uses some sort of ID as a seed (perhaps camera serial number?). I know that the FLIR i7 definitely uses a 320x240 sensor and that they run factory calibration at 250x250 (the sensor is actually 336x252 or something funny like that).

[mikeselectricstuff]

Thanks
Is that on the camera side through the serial connection, enabling RNDIS?

At the moment you need a serial connection, accessable after removing 2 screws to get the facia off. Once you have this you don't need RNDIS as you can copy files between the user file area. The only thing that can only be done via RNDIS is the service/cal functions.
If we can find the secret menu to enable RNDIS via the keypad, then it can be done without opening the case,via telnet

[cartti]

Can someone share files that are not included in the fw update pack? (gui and cmd)

[amyk]

It could be that those extra menus are triggered by the presence of a file (like the highres mode), which is put there at the factory and gets deleted afterwards - thus locking the functionality out and requiring physical access to restore.

...How long until homebrew firmware running on this, with a better non-laggy UI and more functionality? The hardware doesn't seem all that complex to work with.

[mikeselectricstuff]

Can someone share files that are not included in the fw update pack? (gui and cmd)

I've not found a way to copy off .exe files - it doesn't let you copy to another drive or FTP - may try booting in safe mode to see if this helps. Would be good to know all the modes of usbfn as it would be handy to have RNDIS, MSD and UVC all working.

[Pinkus]

It has only been tested with Firmware V1.18.8 It seems likely that 1.18.7 may be also OK looking at the update files.

Just to let everybody know who is thinking about a purchase: the E4 I yesterday purchased online (and which just arrived) in Germany has Firmware 1.18.8. Hardware information says its "E4 1.0".
Unfortunately I cannot proceed now with the hack .... vacation time!
It has to wait now for a week..... can't wait to return to hack it.

But even in 80x60 mode I can say so far: due to MSX even this low res is quite useful, that was a clever idea from Flir.

[mikeselectricstuff]

It could be that those extra menus are triggered by the presence of a file (like the highres mode), which is put there at the factory and gets deleted afterwards - thus locking the functionality out and requiring physical access to restore.

Seems unlikely - at the factory they have a physical connection available so wouldn't need a way to configure via the keypad. I also doubt it would involve putting stuff on the user partition, as the settings could prevent access to this, though one possibility could be that it will only do it of it sees USB power.
Keeping it simple seems to me to be the most likely approach, not depending on anything that could be inaccessible under certain conditions

...How long until homebrew firmware running on this, with a better non-laggy UI and more functionality? The hardware doesn't seem all that complex to work with.

A possibility, but how much more functionality would there need to be to make it worth the effort? You'd also need to include their FPGA file, but if you left the factory filestructure in place, it would be in there anyway.
Assuming (as seems likely) the FPGA does most of the work and feeds a ready-to-display combined image into the camera interace it may not be a huge effort for someone who knows the processor. The main thing you'd need to figure out is how it talks to the FPGA and what data is passed  - likely to be an I2C or SPI interface.
A potential issue may be getting the bootloader to load foreign code.
There is also the issue of figuraing out how factory cal data is dealt with.

.so what other functionality might be useful...?
Higher framerate is the obvious one, though may need a bigger lens to be useful.
Higher temperature  resolution at lower framerate
Video recording, but memory capacity, and maybe CPU power for compression may be limiting.
Timelapse/ take pictured on motion detection (good for wildlife?)
Auto MSX distance detection ( may not have access to both datastreams though)
Some of these would be doable by plugging into PC/RasPi etc.

Not sure I can see it happenning.

[PA0PBZ]

I unpacked NK.bin and have a zip file available to anyone interested (174 files, 4.4Mb zipped)

https://www.dropbox.com/s/g7ix9z3idp1zxsa/nk.zip

[mikeselectricstuff]

Cool! has all the Windows files that it won't let me copy.
CMD.exe has some bitmaps inside, including an image of the command prompt - odd
autoloadcheck.exe has a FLIR logo - boot screen (startup or wake from sleep) perhaps

[cartti]

I unpacked NK.bin and have a zip file available to anyone interested (174 files, 4.4Mb zipped)

https://www.dropbox.com/s/g7ix9z3idp1zxsa/nk.zip

Thank you. These are from different model (mips processor), so ppl do not even try using these in E4.

Edit: Still missing GUI.exe tho, grr.. 

[mikeselectricstuff]

I unpacked NK.bin and have a zip file available to anyone interested (174 files, 4.4Mb zipped)

https://www.dropbox.com/s/g7ix9z3idp1zxsa/nk.zip

Thank you. These are from different model (mips processor), so ppl do not even try using these in E4.

Edit: Still missing GUI.exe tho, grr.. 

Are you sure - references to ASCO, and build date of September.
I don't have cam to hand to compare - will check later

[cartti]

I unpacked NK.bin and have a zip file available to anyone interested (174 files, 4.4Mb zipped)

https://www.dropbox.com/s/g7ix9z3idp1zxsa/nk.zip

Thank you. These are from different model (mips processor), so ppl do not even try using these in E4.

Edit: Still missing GUI.exe tho, grr.. 

Are you sure - references to ASCO, and build date of September.
I don't have cam to hand to compare - will check later

# Format      : Portable executable for MIPS R4000 (PE)

Oh wait. Some of the files are for ARM and some for MIPS. CMD.exe and some .dll's were Mips that i looked through, but now after looking at some random other files they are for ARM.

Maybe fw installer just picks right files for right model or?...

[PA0PBZ]

Not sure, but these are from the Z3comb_v1.18.7 I downloaded from the Flir web site as the update for Ex.

[mikeselectricstuff]

Not sure, but these are from the Z3comb_v1.18.7 I downloaded from the Flir web site as the update for Ex.

I had an old ARM disassembler bork at E4 files complaining they weren't ARM - maybe  some confusion over processor ID headers somewhere.
What are you using to look at them & how old is it?
Will compare with installed files when I get home.
 

[PA0PBZ]

I looked at the cmd.exe COFF file header and yes, the machine type field (at offset 0xC4) says 0x166, that's MIPS for sure.
I checked a few others and they all have 0x166. I'm beginning to think that NK.bin has 2 sections and I unpacked the wrong section.

To be continued...

[mrflibble]

I'm beginning to think that NK.bin has 2 sections and I unpacked the wrong section.

What did you use to extract from .bin?

[PA0PBZ]

What did you use to extract from .bin?

I used NKtools, that seems to be the way to go. I don't think there is another section in the NK.bin, since the size is almost exactly the size of the extracted files, and I don't think there is any compression.

From camera.cmd (the update tool):

Code: [Select]

$LABEL checkinstallOS
dir /B \temp
[*OS*][$GOTO os]
$GOTO checkinstallOSEnd
$LABEL os
# Install OS here
# $SHOW "Updating OS"
delete nk.bin
delete nk.crc
delete gethwtype.exe
delete osimg.rev

#
#
addfile /nk.bin
addfile /nk.crc
## 70
#
kitcrc -c \nk.crc
[*FAIL*][$FAIL "Bad checksum on transferred OS",3]
$TIMEOUT 360
flash -l -n nk.bin
#
$LABEL checkinstallOSEnd
So it looks like they just flash the bin file, I'm puzzled 

[PA0PBZ]

Ok, so kernel.dll has the 0x166 signature for MIPS, but also has the text "Windows CE Kernel for ARM (Thumb Enabled) Built on May  7 2012 at 12:47:43".