Poll

Has the hackabiliy of the E4 made you buy one :  

Yes, I was already looking at the competition at a similar price, but the hack swung it to E4
254 (26.9%)
Yes, I'd not considered buying a TIC before, but 320x240 resolution at this price justifies it (as either tool or toy!)
436 (46.1%)
Yes, I was going to buy an E5/6/8 class of unit but will now get the E4
46 (4.9%)
No, but am looking out for a cheap i3 to hack
47 (5%)
Not yet, but probably will if now that a closed-box hack becomes is possible
162 (17.1%)

Total Members Voted: 779

Author Topic: Flir E4 Thermal imaging camera teardown  (Read 2940436 times)

0 Members and 3 Guests are viewing this topic.

Online mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 12344
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #1525 on: November 18, 2013, 05:55:47 pm »
I called PASS in the UK today, which is where I got my E4, to place an order for some Fluke gear.
The salesman got chatting about the E4 and the hack and said "you were lucky, the next lot are going to be hack proof"  :-DD
..to which the answer would be "well good luck with selling those then..."

Yes I was very tempted!

Would be interesting if dealers started getting loads of orders specifying that the order is contingent on the earlier firmware version...

Certainly anyone ordering now should make it clear that only FW1.19.8 or earlier is acceptable as a condition of order.
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline mrflibble

  • Super Contributor
  • ***
  • Posts: 2025
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #1526 on: November 18, 2013, 06:00:30 pm »
The salesman got chatting about the E4 and the hack and said "you were lucky, the next lot are going to be hack proof"  :-DD

He probably meant to say "we were lucky the current lot is not hack proof". An easy mistake to make, especially when you're still feeling a bit giddy after reading the recent sales report.
 

Offline Taucher

  • Frequent Contributor
  • **
  • Posts: 456
  • Country: de
  • 1DsaYDGWXEYhEKL rfrbFyYsehaAtfBWawf
Re: Flir E4 Thermal imaging camera teardown
« Reply #1527 on: November 18, 2013, 07:16:12 pm »

Btw - did anybody have success in taking a look into an Exx series model yet?
I'd really love to know what wlan/bt hardware is beeing used there - and where it is connected :)

Offline ixfd64

  • Frequent Contributor
  • **
  • Posts: 323
  • Country: us
    • Facebook
Re: Flir E4 Thermal imaging camera teardown
« Reply #1528 on: November 18, 2013, 08:03:50 pm »
I hope the guy was only joking about the newer E4's being hack-proof.

Ah well, even if FLIR does make the E4 "hack-proof," I'm sure there will be other ways to hack it.

Offline MrSquirrel

  • Contributor
  • Posts: 34
  • Country: gb
Re: Flir E4 Thermal imaging camera teardown
« Reply #1529 on: November 18, 2013, 08:05:20 pm »

Btw - did anybody have success in taking a look into an Exx series model yet?
I'd really love to know what wlan/bt hardware is beeing used there - and where it is connected :)

I can probably help with an E8 but it all hinges on the E4 i've got on order being co-operative or not.

Has anyone looked further into the role the I2C EEPROM is playing? Mike's earlier comments on it were interesting. It looks like one of you guys with an already co-operative E4 could explore the bus with i2c.exe.
« Last Edit: November 18, 2013, 08:25:21 pm by MrSquirrel »
 

Offline pmcouto

  • Supporter
  • ****
  • Posts: 96
  • Country: pt
Re: Flir E4 Thermal imaging camera teardown
« Reply #1530 on: November 18, 2013, 08:40:42 pm »

Btw - did anybody have success in taking a look into an Exx series model yet?
I'd really love to know what wlan/bt hardware is beeing used there - and where it is connected :)

Hi Taucher,

When FLIR launched Ex series, they also launched a new version of Exx series, with new features (ex. MSX), new firmware and a slightly different “look”.
I heard some rumors about this new Exx version hardware: Same base hardware as Ex plus WiFi/BT module and digitizer (touch screen) interface (this may be the unpopulated connector on the PCB, seen in Mike’s teardown).
Please note this is only a rumor – I didn’t have the opportunity to see the new Exx “guts” yet…

If the rumor is true, it may be possible to add some interesting features to Ex series.  >:D

Exx series are 60 Hz TICs.
However, the lens is significantly larger than Ex, so probably Ex will not have an acceptable performance at 60 Hz, if (or should I say when?  :-DD) a hack becomes available…

Regards,
Pedro   
 

Offline G0HZU

  • Super Contributor
  • ***
  • Posts: 2576
  • Country: gb
Re: Flir E4 Thermal imaging camera teardown
« Reply #1531 on: November 18, 2013, 08:53:22 pm »
Quote
But Flir tools doesn't seem to be very useful for anything so not a big deal.


Flir tools does have an annoying user interface (to me) but I do find it fairly useful. You can post process the images to do things like change the size of the HOT/COLD search area. Also it looks like it upscales the images to a higher pixel count making them look a bit more pleasing when blown up.

But I did wonder if Flir Tools could auto update itself via the web and then do a sneaky patch over USB to put the camera back to 80x60.
 

Offline Psi

  • Super Contributor
  • ***
  • Posts: 7829
  • Country: nz
Re: Flir E4 Thermal imaging camera teardown
« Reply #1532 on: November 18, 2013, 09:00:57 pm »
Ah well, even if FLIR does make the E4 "hack-proof," I'm sure there will be other ways to hack it.

Unsoldering the flash chip and mounting it under a WinCE install, (as talked about a while back), should be fairly simple and allow the new firmware to be hacked.
Just wont be able to hack it without opening the case and some technical skill.

Assuming someone doesn't figure out a new usb based hack of course
« Last Edit: November 18, 2013, 09:03:14 pm by Psi »
Greek letter 'Psi' (not Pounds per Square Inch)
 

Online PA0PBZ

  • Super Contributor
  • ***
  • Posts: 4521
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #1533 on: November 18, 2013, 09:09:22 pm »
since there will still be a way to update the firmware the easiest thing would be to have the 1.18 firmware look like 1.22 and 'update' the camera with that.
Keyboard error: Press F1 to continue.
 

Offline Wann

  • Contributor
  • Posts: 34
  • Country: dk
  • Mechanical engineer gone rogue
Re: Flir E4 Thermal imaging camera teardown
« Reply #1534 on: November 18, 2013, 09:12:40 pm »
since there will still be a way to update the firmware the easiest thing would be to have the 1.18 firmware look like 1.22 and 'update' the camera with that.

Shhhhhh  :'(
Mechanical engineer gone rogue
 

Offline mrflibble

  • Super Contributor
  • ***
  • Posts: 2025
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #1535 on: November 18, 2013, 09:29:10 pm »

Btw - did anybody have success in taking a look into an Exx series model yet?
I'd really love to know what wlan/bt hardware is beeing used there - and where it is connected :)

I can probably help with an E8 but it all hinges on the E4 i've got on order being co-operative or not.

Has anyone looked further into the role the I2C EEPROM is playing? Mike's earlier comments on it were interesting. It looks like one of you guys with an already co-operative E4 could explore the bus with i2c.exe.

Already tried that. i2c.exe doesn't get you too all that much interesting info (lots of 0xff). First passive snooping on the bus during startup and when required some active reading/writing might get more results.
 

Offline MrSquirrel

  • Contributor
  • Posts: 34
  • Country: gb
Re: Flir E4 Thermal imaging camera teardown
« Reply #1536 on: November 18, 2013, 09:41:46 pm »

If the rumor is true, it may be possible to add some interesting features to Ex series.  >:D

I would raise that from rumor to very likely, but perhaps a different FPGA? Take a look at the Exx series firmware for proof and have a dig around in the .fif files.

The Exx firmware also has additional FPGA .bin files fpga_c4_55.bin & fpga_c55.bin. Looks like it went through a hardware change too, as those seperate files relate to different revisions of the Exx camera. Also, c4_55 and c_55 look like they might relate to some of Altera's own part codes (i'm not an FPGA guy)?

Many of the error strings in the Ex firmware reference features that are only available on the Exx.
 

Offline 0xdeadbeef

  • Super Contributor
  • ***
  • Posts: 1548
  • Country: de
Re: Flir E4 Thermal imaging camera teardown
« Reply #1537 on: November 18, 2013, 10:37:06 pm »
I noticed that after charging, a ghost image of the battery symbol that's shown during loading is still visible when the camera is active.
Does this happen only for me?
I tried stuff like switching to digital camera mode and watching a white wall hoping the "burnt in" image would go away, but no success so far.
Trying is the first step towards failure - Homer J. Simpson
 

Offline mrflibble

  • Super Contributor
  • ***
  • Posts: 2025
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #1538 on: November 18, 2013, 10:39:08 pm »

If the rumor is true, it may be possible to add some interesting features to Ex series.  >:D

I would raise that from rumor to very likely, but perhaps a different FPGA? Take a look at the Exx series firmware for proof and have a dig around in the .fif files.

The Exx firmware also has additional FPGA .bin files fpga_c4_55.bin & fpga_c55.bin. Looks like it went through a hardware change too, as those seperate files relate to different revisions of the Exx camera. Also, c4_55 and c_55 look like they might relate to some of Altera's own part codes (i'm not an FPGA guy)?

Many of the error strings in the Ex firmware reference features that are only available on the Exx.

Been there done that. ;) fpga.bin sizes suggest similar complexity, if not downright the exact same fpga device. IIRC at least one of the bit files for Exx is slightly smaller than for the Ex. As in just might be that at least one Exx board revision uses the same fpga device as for Ex.

*checks*
./flir_ex_pn639_v1.18.7/Z3comb_v1.18.7/FlashBFS/system/fpga.bin 626970 bytes
./flir_exx_pn490_v2.23.14/E2comb_v2.23.14/FlashFS/system/fpga.bin 592029 bytes

I'd be real interested in 1) knowing the fpga device on the Exx, and 2) some macro shots of the pcb.

Hell, while we are speculating ... the first Exx series + the date on that sensor die in Mike's vid. Similarities anyone? Form factor of Exx vs Ex? It looks pretty damn likely that the Ex is an evolution of the Exx design. Downgrade here and there, and introduce it in a lower price bracket.

And as pointed out, appcore.exe similarities are also all over the place. As for several of the other .exe files (gethwtype.exe unsurprisingly).

So time for someone to pop open an Exx and take a vid or some pics.  ;D

The Exx firmware also has additional FPGA .bin files fpga_c4_55.bin & fpga_c55.bin. Looks like it went through a hardware change too, as those seperate files relate to different revisions of the Exx camera. Also, c4_55 and c_55 look like they might relate to some of Altera's own part codes (i'm not an FPGA guy)?

Yup, that looks to be the case. If only because if you check the flir support docs, there are 3 versions of the Exx listed. And there are 3 fpga*.bin files.

 

Offline mrflibble

  • Super Contributor
  • ***
  • Posts: 2025
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #1539 on: November 18, 2013, 10:41:10 pm »
I noticed that after charging, a ghost image of the battery symbol that's shown during loading is still visible when the camera is active.
Does this happen only for me?
I tried stuff like switching to digital camera mode and watching a white wall hoping the "burnt in" image would go away, but no success so far.

Nope, you're not the only one. It was reported earlier on, and I confirmed it as well.

After that I think I made a fix for that. I still have to properly test it. Too much other stuff. :P
 

Offline Pinkus

  • Frequent Contributor
  • **
  • Posts: 665
Re: Flir E4 Thermal imaging camera teardown
« Reply #1540 on: November 18, 2013, 11:24:01 pm »
Is there a way to change the written EXIF information in the firmware? I would like the camera to leave/change the serial number which is otherwise written to with each picture and also to change the written E4 to E8 at the EXIF camera model place.
Maybe somebody already stumbled on it.

P.S. Of course it can be changed later with some tools but best would be to let the camera write the wanted information right away thus eliminating any later file procession.
« Last Edit: November 18, 2013, 11:25:42 pm by PeterK13 »
 

Offline bernroth

  • Regular Contributor
  • *
  • Posts: 125
  • Country: de
Re: Flir E4 Thermal imaging camera teardown
« Reply #1541 on: November 18, 2013, 11:39:01 pm »
I just created a makefile to compile the crc01 tool on OSX and Linux with gcc (g++)
I am thinking about extending the source code in order to append serial number (ID) and checksum (CRC01) automatically to a raw settings file.
The file will then be correct with CRLF etc.. and few risk to make something wrong.
This would ease the process a lot as I have seen many questions about formatting the file.

Pls let me know you opinions :)
 

Offline mrflibble

  • Super Contributor
  • ***
  • Posts: 2025
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #1542 on: November 19, 2013, 12:05:33 am »
Didn't Taucher already make a patch like that for windoze? And in linux country I've got a bash script lying around for ages now to do things automatically.. But I figured it was a bit pointless what with rndis, chickens, eggs, and relative linux/windows clue distributions.

But if you are about to flush time into it, might as well save you some time at least for the *nix side of things

Make sure you have the todos/fromdos tools. You want to have those anyways.
Code: [Select]
apt-get install tofrodos

Make sure the E4 is attached as mass storage device and mounted somewhere. See the attached tgz, and run autohack.sh. Well, almost autohack anyways, since I didn't manage to get rndis working at that time. It spits out a .fif ready to be used with your serial.

I'm pretty sure it works, since I used this to hack mine. :P


PS: It's a tgz, so just unpack with tar xvzf e4_autohack.tgz.zip. Silly forum limitations on attachment filenames...
PPS: It tries to automatically find the right mountpoint. If you don't like a script running a find like that, you're opinionated enough to provide the right filename by hand. ;)
« Last Edit: November 19, 2013, 03:28:46 am by mrflibble »
 

Offline 0xdeadbeef

  • Super Contributor
  • ***
  • Posts: 1548
  • Country: de
Re: Flir E4 Thermal imaging camera teardown
« Reply #1543 on: November 19, 2013, 12:12:25 am »
Call me stupid, but while in can connect to FTP in RNDIS mode, the ftp server refuses to accept "3lvig" as password for the user "root" or "flir".
I tried FileZilla, SmartFTP and the command line FTP client.
The weird thing is that I managed once to login with the command line FTP client, then tried SmartFTP and since then, it doesn't work anymore at all.
I rebooted my PC serveral times, switched off the E4, removed the battery, switched USB modes etc.
The outcome is now always the same: root/3lvig or flir/3lvig are refused for FTP and also for the web frontend.
What the heck is the trick there???
« Last Edit: November 19, 2013, 12:16:51 am by 0xdeadbeef »
Trying is the first step towards failure - Homer J. Simpson
 

Offline mrflibble

  • Super Contributor
  • ***
  • Posts: 2025
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #1544 on: November 19, 2013, 12:16:08 am »
The trick is obviously to use winscp as ftp client because winscp doesn't suck, but mostly ..... use flir/3vlig (aka not what you used).
 

Online mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 12344
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #1545 on: November 19, 2013, 12:16:18 am »

Btw - did anybody have success in taking a look into an Exx series model yet?
I'd really love to know what wlan/bt hardware is beeing used there - and where it is connected :)

I can probably help with an E8 but it all hinges on the E4 i've got on order being co-operative or not.

Has anyone looked further into the role the I2C EEPROM is playing? Mike's earlier comments on it were interesting. It looks like one of you guys with an already co-operative E4 could explore the bus with i2c.exe.

I do have some dumps of I2C traffic but stopped looking once I realised that the config doesn't appear to come from there, and that if you change the resolution figure it gets changed back.
My best guess is the eeprom contains the serial number, so it isn't lost of the flash ever gets reinitialised,  and is also used temporarily as a way to communicate the resolution setting back from the application environment to either an early part of the boot process,  or the FPGA.


Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline 0xdeadbeef

  • Super Contributor
  • ***
  • Posts: 1548
  • Country: de
Re: Flir E4 Thermal imaging camera teardown
« Reply #1546 on: November 19, 2013, 12:19:48 am »
The trick is obviously to use winscp as ftp client because winscp doesn't suck, but mostly ..... use flir/3vlig (aka not what you used).
Damn it, "3lvig" is given several times in this thread. So obviously the the one time it worked I misspelled it and by chance got the correct "3vlig" spelling this way.
Thanks, I was about to get crazy.
Trying is the first step towards failure - Homer J. Simpson
 

Offline olsenn

  • Frequent Contributor
  • **
  • Posts: 993
Re: Flir E4 Thermal imaging camera teardown
« Reply #1547 on: November 19, 2013, 12:20:51 am »
My E4 arrived today. For those of you who are keeping track, here's my unit information:

                                Serial: 63905XXX
               Calibration Date: 10/23/2013
                          Firmware: 1.18.8
 

Offline mrflibble

  • Super Contributor
  • ***
  • Posts: 2025
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #1548 on: November 19, 2013, 12:27:04 am »
Damn it, "3lvig" is given several times in this thread. So obviously the the one time it worked I misspelled it and by chance got the correct "3vlig" spelling this way.
Thanks, I was about to get crazy.

Easy enough to remember, since the software dudes are Swedish, and trevlig is swedish for positive things. ;)
 

Offline 0xdeadbeef

  • Super Contributor
  • ***
  • Posts: 1548
  • Country: de
Re: Flir E4 Thermal imaging camera teardown
« Reply #1549 on: November 19, 2013, 12:37:15 am »
For those who don't speak Swedish though, 3vlig and 3lvig both sound plausible ;)
Anyway, I exhanged the battery_frame.bmp and flash_graybackground.bmp with much darker versions now. Hope this helps.
At least the ghost image of the battery symbol has nearly disappeared now...
Trying is the first step towards failure - Homer J. Simpson
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf