Poll

Has the hackabiliy of the E4 made you buy one :  

Yes, I was already looking at the competition at a similar price, but the hack swung it to E4
274 (27.9%)
Yes, I'd not considered buying a TIC before, but 320x240 resolution at this price justifies it (as either tool or toy!)
444 (45.3%)
Yes, I was going to buy an E5/6/8 class of unit but will now get the E4
49 (5%)
No, but am looking out for a cheap i3 to hack
50 (5.1%)
Not yet, but probably will if now that a closed-box hack becomes is possible
164 (16.7%)

Total Members Voted: 803

Author Topic: Flir E4 Thermal imaging camera teardown  (Read 3769544 times)

0 Members and 12 Guests are viewing this topic.

Offline sipo75

  • Contributor
  • Posts: 17
Re: Flir E4 Thermal imaging camera teardown
« Reply #2000 on: November 30, 2013, 02:10:41 pm »
itc has a YouTube channel

Emissivity Explained in Plain English


itc channel
https://www.youtube.com/user/infraredtraining/videos
 

Offline Mr-Beamer

  • Contributor
  • Posts: 18
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #2001 on: November 30, 2013, 02:41:51 pm »
Probably some have already seen this
 

Offline mrflibble

  • Super Contributor
  • ***
  • Posts: 2051
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #2002 on: November 30, 2013, 02:48:53 pm »
yeah, it's been discussed before. The unlock password is 1235.
 

Online tom66

  • Super Contributor
  • ***
  • Posts: 6678
  • Country: gb
  • Electronics Hobbyist & FPGA/Embedded Systems EE
Re: Flir E4 Thermal imaging camera teardown
« Reply #2003 on: November 30, 2013, 03:04:53 pm »
Haha, how lazy can you get?!
 

Offline jdesbonnet

  • Newbie
  • Posts: 7
Re: Flir E4 Thermal imaging camera teardown
« Reply #2004 on: November 30, 2013, 05:54:09 pm »
Small (I hope) hickup on loading the FIF (E4 firmware 1.19.8, FLIRInstallNet from FLIR tools 4.0.13330.1003, Windows 7 64 bit). I'm getting a "RESPONSE_TIMEOUT" in a dialog box when attempting to upload the FIF file generated with the e4hack3b.zip and then:

Connection timeout
Operation aborted
NoAdapter

in the main area of FLIRInstallNet. The tool does find the camera as "FLIR USB Video -"  and the "Get Versions" button works (reporting the camera's firmware etc). I'm going to try rebooting windows but since I'm in that piece of junk only once a year it takes about a day to reboot thanks to uncancellable updates on power down.

Update 1 Dec 2013: Ya, took a while to reboot Windows due to all the updates since the last reboot about a year ago. So worked perfectly after the Windows reboot. What had me worried was that some elements of the FLIRInstallNet software were communicating with the camera, but not the FIF uploader.
« Last Edit: December 01, 2013, 04:22:24 pm by jdesbonnet »
 

Offline cynfab

  • Regular Contributor
  • *
  • Posts: 175
  • Country: us
Re: Flir E4 Thermal imaging camera teardown
« Reply #2005 on: November 30, 2013, 06:53:12 pm »
Figured out how to telnet into my E4+ from linux.

>>> EDIT and the web & ftp interfaces work too.
Make sure the camera is in RNDIS mode.
AND that this is the only network interface active at the time.

First plug in your camera, and set up the resulting pseudo ethernet interface (varies by distro) to have a static IP of
192.168.250.3.

>>>> EDIT could probably add the default GW as well in the network management tool.

Unplug the camera wait 5-10 seconds then plug it back in.

Then, as root,

arp -s 02:40:7f:xx:yy 192.168.250.2
-------^^^^^^^^^^   your mac address with 02 instead of  00 at the front.

I then ping the camera

ping 192.168.250.2

Then, again as root,

route add default gw 192.168.250.2

and lo I can telnet to the camera!

telnet 192.168.250.2

 I'd love for someone else to try this and see if it works for them, I've spent a lot of time going through WireShark dumps of ethernet traffic between the camera and Win 7 and this is the simplest way to brute force it in linux.
YMMV.
   ...ken...
« Last Edit: November 30, 2013, 07:03:03 pm by cynfab »
 

Online Fraser

  • Super Contributor
  • ***
  • Posts: 13148
  • Country: gb
Re: Flir E4 Thermal imaging camera teardown
« Reply #2006 on: November 30, 2013, 07:06:15 pm »
From FLIR's Youtube site.

How to make an MSX fusion image of a PCB by combining a thermal image with a separate photo taken with a digital camera. This could be useful when doing close-up work where the Ex camera is of little help. It looks like you need FLIR Tools+ but I believe that is available as a demo version ?

If I have helped you please consider a donation : https://gofund.me/c86b0a2c
 

Offline Taucher

  • Frequent Contributor
  • **
  • Posts: 456
  • Country: de
  • 1DsaYDGWXEYhEKL rfrbFyYsehaAtfBWawf
Re: Flir E4 Thermal imaging camera teardown
« Reply #2007 on: November 30, 2013, 07:14:50 pm »
Figured out how to telnet into my E4+ from linux.

>>> EDIT and the web & ftp interfaces work too.
Make sure the camera is in RNDIS mode.
AND that this is the only network interface active at the time.

Great news and congrats :)
Hint: you should be able to access the filesystem over the SMB share as well :)

Regarding "only active NIC" ... I'd try to get rid of the default gateway - and just add a route... this way your running IP setup should continue to work in parallel.

Offline cynfab

  • Regular Contributor
  • *
  • Posts: 175
  • Country: us
Re: Flir E4 Thermal imaging camera teardown
« Reply #2008 on: November 30, 2013, 07:24:49 pm »
Taucher,

I am by no means a networking expert, and this method can certainly be refined, but it is fairly simple and works. ;>))
 

Offline MrSquirrel

  • Contributor
  • Posts: 34
  • Country: gb
Re: Flir E4 Thermal imaging camera teardown
« Reply #2009 on: November 30, 2013, 10:41:07 pm »
So, exactly 3 weeks after giving my money to PASS, for a unit they confirmed to have, I finally received my E4 today.

Glad you posted that - it reminded me to check whether they credited the order i cancelled on 25th. Guess what - they haven't !

Going to kick up hell on Monday - this isn't funny on top of the pack of lies i've been spun (and clearly not the only one).

I won't be dealing with them in future, you might say i'll be giving them a PASS.
 

Offline cynfab

  • Regular Contributor
  • *
  • Posts: 175
  • Country: us
Re: Flir E4 Thermal imaging camera teardown
« Reply #2010 on: November 30, 2013, 10:44:15 pm »
And a somewhat simpler method

Make sure the camera is in RNDIS mode, other network interfaces are fine as long as they are not on 192.168.250.x.

First, on your linux box, as root:

echo 0 > /proc/sys/net/ipv4/conf/all/arp_accept

Then, as before, plug in your camera, and set up the resulting pseudo ethernet interface (varies by distro) to have a static IP of
192.168.250.3.

Unplug the camera wait 5-10 seconds then plug it back in. (This may not be necessary and there is probably an easier way )

Then you can ping, telenet, ftp, & use the web interface. I've tried the SMB interface, but it doesn't seem to work, probably due to the lack of NETBIOS exchanges that occurred on the Win 7 box.
 

Offline Taucher

  • Frequent Contributor
  • **
  • Posts: 456
  • Country: de
  • 1DsaYDGWXEYhEKL rfrbFyYsehaAtfBWawf
Spying Bastards
« Reply #2011 on: December 01, 2013, 12:11:45 am »
Nice Taucher
I see GoogleAnalyticsTracker.dll is in the previous version also
Without it in the progdir Flirtools crashes
Ok, stole myself some additional time and did an investigation on the Google Analytics DLL:

Found URLs inside DLL:
http://www.google-analytics.com/__utm.gif
https://ssl.google-analytics.com/__utm.gif

As said had to check my hosts file first ... had them blacklisted already...
0.0.0.0      ssl.google-analytics.com
0.0.0.0      www.google-analytics.com
... ok, temporarily redirected them for testing to my local http-server.. fired up the tools and :wtf:  hold and beware...
BINGO, HOME-CALLING!

:rant: "Bloody, Spying BASTARDS" :rant:
 :-- :-- :-- :-- :-- :-- :-- :-- :-- :--

This (and more) is beeing sent to Google:

When starting:   

   &utmn=<SOME NUMBER>
   &utmhn=<THE WINDOWS MACHINE HOSTNAME>
   &utme=5(Application start*4.0.13284.1003*)(0)8(Origin*OSCulture*OSBits)9(EXTERNAL*<LOCALE>*<OS-BITS>)....

When opening the images browser:
   &utmdt=Library Tab   

When looking at an image:

   &utmdt=Edit Window 
   
Feel free to contribute more!


I understand developers who want to optimize their product and provide the user with a better experience, but then... what for do they need my machine's name for?!
Tons of additional numbers beeing sent (click/mouse coordinates?) ... could also be encoded username, password, IP... (ok, that's now just my paranoia kicking in)...
Opt-out function: didn't see any

I don't like that at all!

PS: sending referer: http://library.tools.flir.com

Offline mrflibble

  • Super Contributor
  • ***
  • Posts: 2051
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #2012 on: December 01, 2013, 12:36:20 am »
Regarding rndis on linux, or windoze for that matter:

Code: [Select]
rls -ll .services.net.interface.RNDISFN1

# if this doesn't show the interface, force reconstructing resource tree
restartapp

rls -ll .services.net.interface.RNDISFN1

.services.net.interface.RNDISFN1: (8)
rw--rw--rw---p 0 root   root   <b> DHCP                       false
r---r---r----- 0 root   root   <a> actualAddress    "192.168.250.2"
rw--rw--rw--0p 0 root   root   <a> address          "192.168.250.2"
rw--rw--rw--1- 0 root   root   <b> commit                     false
rw--rw--rw--0p 0 root   root   <a> gateway          "192.168.250.1"
rw--rw-------- 0 root   root   <u> mac             "02:40:7F:xx:xx:xx"
rw--rw--rw--0p 0 root   root   <a> netmask          "255.255.255.0"
r---r---r----- 0 root   root   <a> tcpConnects      "192.168.250.1"


rset .services.net.interface.RNDISFN1.address 192.168.250.2
rset .services.net.interface.RNDISFN1.gateway 192.168.6.66
rset .services.net.interface.RNDISFN1.commit true

rdump -f \temp\net_gateway.rsc .services.net.interface.RNDISFN1

# inspect .rsc file, and when okay add it to the

move /temp/net_gateway.rsc /FlashFS/system/appcore.d/factory.d/.

restart

For testing purposes the gateway is now set to something different, while
the rest is still at default. Why? Because that way you only have to setup a
default connection between 192.168.250.2 (E4) and 192.168.250.1 (PC), and
you can check if the new setting based on resource has been succesfully
applied or not. I put it in appcore.d right now, but you might want to put network
related stuff in services.d.

If resource based config worked, then you can do a telnet and then "route
print". If you see the 192.168.6.66 test route then it worked. If not, then
not. :P Once you get a reliable method (so far it's too flaky) then you can
apply the proper static values you want.

As for usb plug in out in + adding default routes ... no need for all that. You can simply do this:

/etc/udev/rules.d/70-persistent-net.rules
Code: [Select]
#
# Flir E4 met RNDIS
#
# USB device 0x:0x (rndis_host)
SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="00:40:7f:xx:xx:xx", ATTR{dev_id}=="0x0", ATTR{type}=="1", KERNEL=="eth*", NAME="eth4"

Then in /etc/network/interfaces:
Code: [Select]
auto eth4
iface eth4 inet static
        address 192.168.250.1
        netmask 255.255.255.0
        up arp -i eth4 -s 192.168.250.2 02:40:7f:xx:xx:xx

Obviously change the xx:xx:xx entries to match your own MAC.

If you want your linux box to route packets for the E4 as well so you can
fuel your paranoia like Taucher, then you'll have to enable forwarding.
Personally I keep this OFF. :P If I need ftp forwarded I'll set up a seperate rule for that.

You can also enable DHCP using the above rset method if you feel like it.

SMB should just work. By default there isn't all that much to be had
though. Just the IPC ...

Code: [Select]
nmblookup -A 192.168.250.2

...

nmblookup IRCAM.... -B 192.168.250.2

querying IRCAM.... on 192.168.250.2
192.168.250.2 IRCAM....<00>

smbclient -L IRCAM....

smbclient  '\\IRCAM....\IPC$' 3vlig

And does anyone else get that the battery refuses to charge when it's really
low? Right now it's looooow, so I can start it for maybe 10 seconds and then
it goes poof again. When I show battery stats (hold LEFT + RIGHT cursor) it
shows Battery: 3%, 13mA ... but no charging (lightning) symbol.
Sound familiar, or do I just have a crappy battery or something?

Oh yeah, and I had some details on flash as well, but can't reach it now
because ... well 3% battery.  :P And NOT charging, GRRRRR.

« Last Edit: December 01, 2013, 01:03:44 am by mrflibble »
 

Offline mikeselectricstuffTopic starter

  • Super Contributor
  • ***
  • Posts: 13694
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #2013 on: December 01, 2013, 12:53:17 am »
Could be that when very low it starts charging at a low rate for a while in case it's a faulty batery
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Online Fraser

  • Super Contributor
  • ***
  • Posts: 13148
  • Country: gb
Re: Spying Bastards
« Reply #2014 on: December 01, 2013, 12:55:49 am »

I understand developers who want to optimize their product and provide the user with a better experience, but then... what for do they need my machine's name for?!
Tons of additional numbers beeing sent (click/mouse coordinates?) ... could also be encoded username, password, IP... (ok, that's now just my paranoia kicking in)...
Opt-out function: didn't see any

I don't like that at all!

PS: sending referer: http://library.tools.flir.com

FLIR use quite a tough anti-piracy procedure on their software as it is a very expensive optional accessory that they wish to protect. FLIR Tools is free but may be upgraded to FLIR Tools+. The activation of Tools+ is likely to be similar to that of the other FLIR software as it costs around $400.

Could it be that the Google data exfiltration is part of an anti-piracy protection system ?

Like you, I am unhappy if my computer is passing my activities with FLIR Tools to FLIR via Google collection agents. As I am registered with FLIR HQ they could likely correlate me with the build state of my camera so such data would not be anonymous. I don't recall agreeing to that but its likely buried in the EUL. Not too happy with this finding. ET phone home indeed ! 
« Last Edit: December 01, 2013, 12:57:56 am by Aurora »
If I have helped you please consider a donation : https://gofund.me/c86b0a2c
 

Offline Taucher

  • Frequent Contributor
  • **
  • Posts: 456
  • Country: de
  • 1DsaYDGWXEYhEKL rfrbFyYsehaAtfBWawf
Re: Flir E4 Thermal imaging camera teardown
« Reply #2015 on: December 01, 2013, 12:57:09 am »
If you want your linux box to route packets for the E4 as well so you can
fuel your paranoia like Taucher, then you'll have to enable forwarding.


SMB should just work. By default there isn't all that much to be had
though. Just the IPC ...


And does anyone else get that the battery refuses to charge when it's really low?

@USB - Check your USB power status - lsusb -v / hwinfo --usb / hwinfo --usb-ctrl ... maybe hard-reboot your cam after hacking it's soul to death? ;)

@SMB - did you note how niceliy the hostname is generated from the SN?  ;D

@Paranoia - I'm still missing my http://en.wikipedia.org/wiki/Tin_foil_hat .. my Idol:
  :-/O

Offline Taucher

  • Frequent Contributor
  • **
  • Posts: 456
  • Country: de
  • 1DsaYDGWXEYhEKL rfrbFyYsehaAtfBWawf
Re: Spying Bastards
« Reply #2016 on: December 01, 2013, 01:01:22 am »
Like you, I am unhappy if my computer is passing my activities with FLIR Tools to FLIR via Google collection agents. As I am registered with FLIR HQ they could likely correlate me with the build state of my camera so such data would not be anonymous. I don't recall agreeing to that but its likely buried in the EUL. Not too happy with this finding. ET phone home indeed !
Well, my paranoid, default OS setup took care of that home calling - feel free to adjust your hosts-file or windows firewall rules to take care of the unwanted data traffic :)

Offline KingVidiot

  • Contributor
  • Posts: 19
Re: Flir E4 Thermal imaging camera teardown
« Reply #2017 on: December 01, 2013, 01:02:09 am »
With these mods can you guys find a way to toggle the annoying calibration popup on and off?

I don't want to be streaming video to my computer and have that damn thing continue to popup. When I shoot video I don't care if it's always fully calibrated.

Heh, that was one of the first things I fixed. Damn annoying to have it perform a nuc (calibration) juuuust when you're doing a measurement.


Code: [Select]
# turn off auto-nuc
rset .tcomp.services.autoNuc.active false

# turn on auto-nuc
rset .tcomp.services.autoNuc.active true

# trigger nuc
rset .image.services.nuc.commit true

The idea is to turn off auto-nuc, and then trigger a nuc when you think it's useful. I.e between measurements. Or not at all.  ;D

Happy uninterrupted video streaming!

I really need to be able to toggle the calibration for video streams (no choppy vids). I heard that you can force a calibration with one of the buttons, so it doesn't need to come on all the time.

OK, E4 hack is working well, but I need to fix this calibration step. What file do I edit to change the NUC values?
 

Offline mrflibble

  • Super Contributor
  • ***
  • Posts: 2051
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #2018 on: December 01, 2013, 01:07:07 am »
Could be that when very low it starts charging at a low rate for a while in case it's a faulty batery

Good point, and looks to be likely too. Right now it is at 4% and 35mA (as opposed to 3%, 13mA earlier on).
 

Offline Taucher

  • Frequent Contributor
  • **
  • Posts: 456
  • Country: de
  • 1DsaYDGWXEYhEKL rfrbFyYsehaAtfBWawf
Re: Flir E4 Thermal imaging camera teardown
« Reply #2019 on: December 01, 2013, 01:08:17 am »
I really need to be able to toggle the calibration for video streams (no choppy vids). I heard that you can force a calibration with one of the buttons, so it doesn't need to come on all the time.
OK, E4 hack is working well, but I need to fix this calibration step. What file do I edit to change the NUC values?
Manual Re-Cal(NUC): keep holding down "Playback"
@File: you can probably put it in any <additional config> file that you like <as long as it's getting loaded> - or just run the wanted commands via telnet before recording a vid.
If you're asking yourself about rset and how to ... -> use telnet and don't use any file as this will change the default settings after startup.
« Last Edit: December 01, 2013, 01:10:11 am by Taucher »
 

Offline mrflibble

  • Super Contributor
  • ***
  • Posts: 2051
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #2020 on: December 01, 2013, 01:16:14 am »
@USB - Check your USB power status - lsusb -v / hwinfo --usb / hwinfo --usb-ctrl ... maybe hard-reboot your cam after hacking it's soul to death? ;)

Heh, did that already, and also changed usb ports. Nothing. To be on the safe side I hooked it up to the 100% Flir approved charger.... But it looks to be just a safe slow charge like Mike pointed out.

Quote
@SMB - did you note how niceliy the hostname is generated from the SN?  ;D
I did notice that I am pretty sleepy. :palm: I'm not overly worried about serials though, but fixed on general principle, thanks. On that subject, you know you put your user/machine name in the HTTP request a few pages ago, right? Not that those were highly exciting, but just so you know. :P
 

Offline Taucher

  • Frequent Contributor
  • **
  • Posts: 456
  • Country: de
  • 1DsaYDGWXEYhEKL rfrbFyYsehaAtfBWawf
Re: Flir E4 Thermal imaging camera teardown
« Reply #2021 on: December 01, 2013, 01:20:26 am »
@SMB:
\\192.168.0.2\root$
\\192.168.0.2\windows$
« Last Edit: December 01, 2013, 01:22:46 am by Taucher »
 

Offline mrflibble

  • Super Contributor
  • ***
  • Posts: 2051
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #2022 on: December 01, 2013, 01:25:38 am »
I really need to be able to toggle the calibration for video streams (no choppy vids). I heard that you can force a calibration with one of the buttons, so it doesn't need to come on all the time.
OK, E4 hack is working well, but I need to fix this calibration step. What file do I edit to change the NUC values?
Manual Re-Cal(NUC): keep holding down "Playback"
@File: you can probably put it in any <additional config> file that you like <as long as it's getting loaded> - or just run the wanted commands via telnet before recording a vid.
If you're asking yourself about rset and how to ... -> use telnet and don't use any file as this will change the default settings after startup.

Indeed. I'd keep that bit of config non-permanent. Personally I'd use a telnet script. Or you can make a .FIF that executes those rset commands. That way before you start recording you do pointey clickey in FlirInstallNet, and apply that .FIF.
 

Offline Taucher

  • Frequent Contributor
  • **
  • Posts: 456
  • Country: de
  • 1DsaYDGWXEYhEKL rfrbFyYsehaAtfBWawf
Re: Flir E4 Thermal imaging camera teardown
« Reply #2023 on: December 01, 2013, 01:28:05 am »
On that subject, you know you put your user/machine name in the HTTP request a few pages ago, right? Not that those were highly exciting, but just so you know. :P
I assume you're referencing "EXISTS/EXISTSALSO" ... that's not my username or machine-name ;)

Offline mrflibble

  • Super Contributor
  • ***
  • Posts: 2051
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #2024 on: December 01, 2013, 01:30:41 am »
On that subject, you know you put your user/machine name in the HTTP request a few pages ago, right? Not that those were highly exciting, but just so you know. :P
I assume you're referencing "EXISTS/EXISTSALSO" ... that's not my username or machine-name ;)
That was likely since it was highly contrived, but you never know. But more importantly, 6% @ 1290mA. yay!
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf