Such thermal investigation would be a challenge as the temperature differential inside the Micro-bolometer FPA is intentionally very small. The sensing elements do not produce heat. The resolution of the FireFlIR (320x240) is also too low for die detail, even when using a close-up lens.
Such thermal investigation would be a challenge as the temperature differential inside the Micro-bolometer FPA is intentionally very small. The sensing elements do not produce heat. The resolution of the FireFlIR (320x240) is also too low for die detail, even when using a close-up lens.
Yes, but you could potentially hold a "light" (soldering iron?) over it and see differences in thermal reflectivity on the microbolometer.
Next time I have it apart, I will try with a halogen lamp
Next time I have it apart, I will try with a halogen lamp
If needed, i can send you a 600W HPS plus ballast. That should give you enough heat and light
Greetings,
Chris
How exactly did you get the serial boot data off of the E4? Which pins, and with what PC adapter? Which serial format was it in?
38K4 baud on a pin on the unused FFC connector - I've not had time yet to figure out all the pins, but I2C, CPU reset and power button are on there.
Pins I know so far - all I've done so far is test for input/output using pullup/pulldown resistor
4 & 6 look good candidates for serial in.
Logic levels are 3.3v
Starting from end nearest to the unpopulated FFC connector
1 On/Off switch (to ground)
2 Power - Vbattery during run and charge - possibly via a FET switch as I didn't see continuity to bat terminal
3 Output
4 Input
5 Serial TXD 38K4
6 Input
7 0V
8 /Reset
9 Output
10 Input
11 Output
12 Input
13 Input
14 I2C SDA
15 I2C SCL
16 0V
Someone emailed me last week with info on hacking the i series but was very wary of releasing - apparently there is a power-up key combination that gets you into a config screen, from which you can enable networking and do stuff like changing the resolution of i3 to i7, disabling the text overlay and reducing display noise - don't have it to hand ATM but I think it was something like holding play+down key at startup.
Damn, this is getting intense, sub'd, thanks Mike !
Edit: wrote I4 accidentely - I now corrected it to I3.
OHHHHH - if hacking an I3->I7 would be possible, I would purchase a I3 right away.
I doubt that hacking could be so unbelievable easy but if Mike confirms during the weekend that there is a keyboard combination for enhancing resolution to 140x140 I am going to order one on monday.
The decision would be the same for me as with the Rigol product: only because of the available hacks I purchased DS2072 & DSA815-TG & DG4062: I am willing to spend some money for decent functionality but price/functionality- relation has to be a really good one.
Edit: wrote I4 accidentely - I now corrected it to I3.
OHHHHH - if hacking an I3->I7 would be possible, I would purchase a I3 right away.
Might be worth waiting to see what's possible on the E4, unless i3's are being heaviliy discounted. And no, I don't know anything yet before you ask, but haven't started seriously looking yet.
Maybe worth splitting i-series discussion to a different thread to avoid confusion?
We could almost do with a Thermal camera section on its own....there is a lot of interest in these units and mush fun to be had with them
I thought about starting a thread that will contain pictures taken of electronics using such units to show what is possibkle with teh different models and resolutions.
I would support the i series hacking or investigations being in a separate thread to avoid too much criss crossing within the flow of conversations.
I feel sure that there will be many interested in the whole range of topics and Mike has already proven that many wish to know what 'magic' goes on inside the modern TIC.
All very interesting and informative stuff
At a glance there are a ton more DMM and scope threads than TICs, and they don't get their own section...
But DMMs and scopes are BORING in comparison !
So if you hold the 'load' button down during startup.....
Bootloader 16.3 for ASCO (May 6 2013 11:41:42)
PMIC wake up: R5=40h E_SEQ_RDY R6=1h E_nONKEY
PMIC status: R1=1h nONKEY R2=a0h COMP_DET GP_FB2
Fuel gauge check: res=1, voltage=3704
Reset reason (0x00000000): Power ON
Press [ENTER] to force OS/FS image update (MSD) or [SPACE] to cancel.
Initiating image update in 0 seconds.
Launching flash image ...
+InitSpecifiedEthDevice
INFO: Trying to initialize the built-in USB/MSD...
MSD:: initialization
MSD: USB initialization completed
..and if you then plug it into the PC
USB Attach: High speed
Appears as a drive, but just a couple of uninteresting text files - probably looking for a firmware file to be saved
..and if you send a <space> to the UART during boot....
<quote>
SETTINGS:
0) IP address: 0.0.0.0
1) Subnet Mask: 0.0.0.0
2) Boot delay: 1 seconds
3) DHCP: Enabled
4) Reset to factory default configuration
5) Autoboot: NK from NOR
6) MAC address: 00:40:7F:0B:91:39
7) Host connection: (USB MSD)
ACTIONS:
S) Save configuration
D) Download image now
L) Launch existing flash image now
R) Launch existing flash image now in SAFE (restricted) mode
E) Erase flash file system area
B) Erase OS Image area
</quote>
Option 7 may be intersting - options are USB BSD, ETHERNET and USB RNDIS, which provides virtual ethernet over USB - fairly sure the latter is what enabled the i7 hack - unfortunately I've lost the email I had about that.
Safe mode doesn't do anything interesting
Oh Mike.....you LOST the hack email
Or did you hear the distinctive thump-thump-thump of the black helicopters rotors overhead ?
If you ask GCHQ or the NSA nicely, they may provide you with their copy of the email
Oh Mike.....you LOST the hack email
Or did you hear the distinctive thump-thump-thump of the black helicopters rotors overhead ?
If you ask GCHQ or the NSA nicely, they may provide you with their copy of the email
Yep - hard disk on that laptop was failing around the time I got it - have tried to recover but no joy so far - may still be in there somewhere..
However.....
If you download the Ex firmware from Flir, and rename the .fif file to .cab Many very interesting things appear.... Will take some time to examine....
This looks interesting....
Restarting in high resolution mode/service mode
Especially after seeing those erase options I hope you've dumped the flash image and stored it in a safe place for backup... for recovering from any accidental bricking. One of the first things I do when RE'ing a device is try to get a complete firmware image.
Ahhhh, the infamouse computer hard disk crash..... what you have to ask yourself is.....did it just 'die' or was it Killed by the Dark Net
With regard to the proding of the firmware in your camera. A back-up would be prudent if possible as from what I have learn't each camera is calibrated, and the calibration data is vital to correct image appearance. My PM570 has this important Microbolometer calibration data on the same Flash chip as the OS firmware. It uses a block addressable 28F16 for all its Flash storage needs.
oooh look - I found another serial port...
List of all available commands (+ description)
command /? For more information on a specific command
? List all available commands without description).
ALIAS Sets, removes or shows aliases.
ATTRIB Displays or changes file attributes.
BEEP Beep the speaker.
CALL Calls one batch program from another.
CD Displays the name of or changes the current directory.
CHOICE Waits for the user to choose one of a set of choices.
CLS Clears the screen.
CMD Starts a new instance of the FLIR command line interpreter.
COPY Copies one or more files to another location.
DATE Displays or sets the date.
DELETE Deletes one or more files.
DIR Displays a list of files and subdirectories in a directory.
ECHO Displays messages, or turns command echoing on or off.
ERASE Deletes one or more files.
EXIT Quits the CMD.EXE program (command interpreter).
FOR Runs a specified command for each file in a set of files.
FREE (free) disc space.
GOTO Directs the FLIR command line interpreter to a labeled line in
a batch program.
HELP Provides Help information for FLIR commands.
HISTORY List all commands which has been used
IF Performs conditional processing in batch programs.
MD Creates a directory.
MKDIR Creates a directory.
MOVE Moves one or more files from one directory to another
directory.
PATH Displays or sets a search path for executable files.
PAUSE Suspends processing of a batch file and displays a message.
POPD Restores the previous value of the current directory saved by
PUSHD.
PROMPT Changes the command prompt.
PUSHD Saves the current directory then changes it.
RD Removes a directory.
REM Records comments (remarks) in batch files.
REN Renames a file or files.
RENAME Renames a file or files.
REPLACE Replaces files.
RMDIR Removes a directory.
SCREEN Move cursor and optionally print text.
SET Displays, sets, or removes FLIR command line interpreter environment va
riables.
SHIFT Shifts the position of replaceable parameters in batch files.
START Starts a separate window to run a specified program or command.
Executes command.
TIME Displays or sets the system time.
TIMER Allow the use of ten stopwatches.
TYPE Displays the contents of a text file.
VER Displays the FLIR command line interpreter and Windows CE version.
\>
Entry point into the command line for the Embedded Win CE computer ?.
Now how to extract and edit the boot batch files to change some settings
Looks like a boot filesystem and a 'working' one. Tons of config/cal data. Looks like model assignment may be baked into the cal process to some extent.
Looking to see if I can copy files between the flash Filesystem and the filesystem that's visible through the USB. Any
CE experts out there?