Products > Thermal Imaging

FLIR Boson 640 Variant Teardown (Autoliv NV4?)

(1/2) > >>

BiD:
Hello,

I had picked up some FLIR Boson 640 variant from fleabay recently and notice that basic USB VPC interfacing doesn't work on it and currently working through figuring out it's interfacing.  It's housing look like custom metal housing and it doesn't seem to be the same as the standard ones from FLIR.   Anyhow, wanted to post some teardown of the device and some of the identified pinouts.   I was able to pull the firmware from the flash memory to have a look.

I use Bus Pirate ( http://dangerousprototypes.com/docs/Bus_Pirate ) and flashrom command line tool to dump the firmware via SPI.


Update 2021-07-31:

There's strings in the firmware that indicates it's potentially a Autoliv NV4:

* NV4-Release-60
* NV4-Authblock-Release-60

  Unfortunately, the firmware seems to be encrypted and needs some work to retrieve the key.

Update 2021-08-08:

I've identified the JTAG pads (see attached photo), using
--- Code: ---urjtag
--- End code ---
tool, we're able to confirm it's


--- Code: ---    jtag> detect
    IR length: 4
    Chain length: 1
    Device Id: 00011100010001010000011001100001 (0x1C450661)
    Unknown manufacturer! (01100110000) (/usr/local/share/urjtag/MANUFACTURERS)

--- End code ---

Searching "0x1C450661" indicates it is indeed JTAG for Movidius ma2x5x:

http://eyesofthings.eu/wp-content/uploads/deliverables/EoT_D3.5.pdf

I went through the 80-bin and only see the video sync/clock with activities and I did see some brief clock activities for just a few clock cycles however it stops very soon after.  The video sync/clock is continuous after a brief boot period.

Aside from those ports, so far it looks like the secure-boot firmware disables USB and video outputs (analog and digital).  I assume there's some handshake/key that's needed from an ECU.  The older version, NV2, looks like it needed a key as well:

https://debugmo.de/2018/12/autoliv-nv2-teardown/

would not surprised if they carried this over.

VGN:
Hi, BiD!

Great discover!

As I know there is usb2/3 interface, looks like they are using some custom ASIC to interface the sensor over usb3.0.
Chekout this project: https://hackaday.io/project/160928-boson-frame-grabber
Also look though this schematics at page 4: https://cdn.hackaday.io/files/1609286885143552/bosonFrameGrabber_sch.pdf
Besides USB2/3 there is some 16-bit cmos interface. Can you detect any activity at this 16-bit bus?

BiD:
Thanks!

> As I know there is usb2/3 interface, looks like they are using some custom ASIC to interface the sensor over usb3.0.

It looks to be custom software which runs on Intel Movidius Myriad.

> Checkout this project: https://hackaday.io/project/160928-boson-frame-grabber

I have seen that however it looks like the secure-boot firmware disables all ports.  I assume there's some handshake/key that's needed from an ECU.  The older version, NV2, looks like it needed a key as well:

https://debugmo.de/2018/12/autoliv-nv2-teardown/

would not surprised if they carried this over.


> Besides USB2/3 there is some 16-bit cmos interface. Can you detect any activity at this 16-bit bus?

I went through the 80-bin and only see the video sync/clock with activities and I did see some brief clock activities for just a few clock cycles however it stops very soon after.  The video sync/clock is continuous after a brief boot period.

tmbinc:
Wow, this is exciting! I was looking for NV4 for a while without success.

Can you give me any pointer what to look for on ebay?

ArsenioDev:
If I had to bet, these would be those weird new 2021 Cadillac imagers

Navigation

[0] Message Index

[#] Next page

There was an error while thanking
Thanking...
Go to full version