Poll

Has the hackabiliy of the E4 made you buy one :  

Yes, I was already looking at the competition at a similar price, but the hack swung it to E4
250 (26.8%)
Yes, I'd not considered buying a TIC before, but 320x240 resolution at this price justifies it (as either tool or toy!)
433 (46.4%)
Yes, I was going to buy an E5/6/8 class of unit but will now get the E4
45 (4.8%)
No, but am looking out for a cheap i3 to hack
46 (4.9%)
Not yet, but probably will if now that a closed-box hack becomes is possible
160 (17.1%)

Total Members Voted: 768

Author Topic: Flir E4 Thermal imaging camera teardown  (Read 2843609 times)

0 Members and 1 Guest are viewing this topic.

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 12135
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #225 on: October 25, 2013, 11:55:08 pm »
Quote
There's an opportunity for a new company to start selling official 320x240 TIC for <$1000
Assuming they could buy sensors at the right price, which probably means high volumes.
Quote
The only possible exception to this is if the lens or sensor in the E4 was bin'ed as reject, which would otherwise be thrown away.
The service info on mine showed no dead pixels - it does appear to have the ability map out (mask) dead pixels.
Unless they have significant yield issues, it may well be more hassle than it's worth to to sort out useable rejects from non-useable ones.
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline IanB

  • Super Contributor
  • ***
  • Posts: 9692
  • Country: us
Re: Flir E4 Thermal imaging camera teardown
« Reply #226 on: October 26, 2013, 12:56:38 am »
I may be totally wrong as you know more about the firmware than me, but I have not heard of this noise insertion technique in a TIC before. Bit padding, yes, but not noise insertion.

Maybe I'm preaching to the choir, but noise addition and oversampling is a standard technique for getting more resolution out of a low res sensor (by resolution, I mean more bits per pixel, not more pixels). Essentially you are oversampling the A/D converter. Instead of taking one sample, you take many samples and average them. By itself this may not help much due to sampling bias, but if you add random noise to the input signal and then take multiple samples you can get more bits per reading at the cost of longer time to obtain each reading. By averaging over many samples you not only can get higher resolution (e.g. 9-12 bits from an 8 bit sensor), but you also can reduce noise by averaging it out.

(The way this works is as follows: statistically speaking, an analog value of 37.4/255 on an 8 bit A/D is likely to produce a reading of 37 most of the time. But if you add some random noise and sample multiple times, you will get a reading of 37 about 60% of the time and a reading of 38 about 40% of the time. By averaging over several readings, you will obtain a better estimate of 37.4 rather than 37 or 38.)
I'm not an EE--what am I doing here?
 

Offline Richard Wad

  • Contributor
  • Posts: 10
Re: Flir E4 Thermal imaging camera teardown
« Reply #227 on: October 26, 2013, 08:41:33 am »
Dave, willing to do some tests on the E8 for us?  ;) I can see you watching.
Please - someone find the magic keypresses so Dave can dump the eeprom and config files without opening it!

Hello Mike
First post here, thought I'd say a huge thanks for your efforts on this. I happen to have an E4 also.

Curious, how many possible key presses do you think this could entail? If we include the power on button, there are 8 buttons. If flir chose to make this more difficult, could they have perhaps chosen 2 buttons  to be depressed at the same time?

I can work on this if it exists, how will I know if/when the dump has occurred?
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 12135
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #228 on: October 26, 2013, 08:54:23 am »
Dave, willing to do some tests on the E8 for us?  ;) I can see you watching.
Please - someone find the magic keypresses so Dave can dump the eeprom and config files without opening it!

Hello Mike
First post here, thought I'd say a huge thanks for your efforts on this. I happen to have an E4 also.

Curious, how many possible key presses do you think this could entail? If we include the power on button, there are 8 buttons. If flir chose to make this more difficult, could they have perhaps chosen 2 buttons  to be depressed at the same time?

I can work on this if it exists, how will I know if/when the dump has occurred?
It appears that the hidden menu is are "after" the info (model/ersion/serial no) in the settings->camera information menu ( all entries appear the same). Current best guess is that some key combination at startup (presses or keys held) will enable the additional menu, probably visible by a right-arrow or enter on these menu items.
The i series uses 2 keys pressed together at some point after startup, one of which was an arrow key. My guess would be this is detected after the bootloader - first FLIR screen before export message.
And probably only on a cold boot (battery insert)
Stay tuned to this thread for info - code is disassembled - I'm not working on it but others are.
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline Richard Wad

  • Contributor
  • Posts: 10
Re: Flir E4 Thermal imaging camera teardown
« Reply #229 on: October 26, 2013, 09:18:50 am »
Hi Mike
You're up late. Or early!
OK well I have some time on my hands so I will try all the key combos I can come up with and let you know.
Will it dump to its internal storage the data you are seeking?
 

Offline Psi

  • Super Contributor
  • ***
  • Posts: 7591
  • Country: nz
Re: Flir E4 Thermal imaging camera teardown
« Reply #230 on: October 26, 2013, 09:22:12 am »
The files he wants to dump on an E8 unit isnt an automatic thing. It requires enabling RNDIS and running some commands.

Finding the key combo to get the service menu means this data can be dumped out without taking the unit apart. (Since Dave doesn't want to do that to an E8 on loan.)
« Last Edit: October 26, 2013, 09:26:31 am by Psi »
Greek letter 'Psi' (not Pounds per Square Inch)
 

Offline Richard Wad

  • Contributor
  • Posts: 10
Re: Flir E4 Thermal imaging camera teardown
« Reply #231 on: October 26, 2013, 09:29:56 am »
Thanks
Is that on the camera side through the serial connection, enabling RNDIS?
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 12135
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #232 on: October 26, 2013, 09:39:54 am »
Just had this message  re. i7
The secret key combo for the i7 is to bring up the menu and hold down the gallery key for 5 seconds. The code for it is very visible in gui.exe as it uses a timer and is written in .Net (so it's super easy to disassemble). Perhaps if you disassembled your gui.exe it might be in there?

Also, no special boot conditions are required to enter the service menu. Nor does the key combo need to be pressed during startup.

I got into my i7 some time ago (I was also too nervous to release it ;) ), but I am yet to figure out the "CRC" algorithms on the config files. I think this is the key to modding it, and I think it seems to be based on some sort of RIPEMD160 and uses some sort of ID as a seed (perhaps camera serial number?). I know that the FLIR i7 definitely uses a 320x240 sensor and that they run factory calibration at 250x250 (the sensor is actually 336x252 or something funny like that).

Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 12135
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #233 on: October 26, 2013, 09:43:49 am »
Thanks
Is that on the camera side through the serial connection, enabling RNDIS?
At the moment you need a serial connection, accessable after removing 2 screws to get the facia off. Once you have this you don't need RNDIS as you can copy files between the user file area. The only thing that can only be done via RNDIS is the service/cal functions.
If we can find the secret menu to enable RNDIS via the keypad, then it can be done without opening the case,via telnet
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline cartti

  • Newbie
  • Posts: 3
Re: Flir E4 Thermal imaging camera teardown
« Reply #234 on: October 26, 2013, 10:41:06 am »
Can someone share files that are not included in the fw update pack? (gui and cmd)
 

Online amyk

  • Super Contributor
  • ***
  • Posts: 6813
Re: Flir E4 Thermal imaging camera teardown
« Reply #235 on: October 26, 2013, 11:03:52 am »
:clap:

It could be that those extra menus are triggered by the presence of a file (like the highres mode), which is put there at the factory and gets deleted afterwards - thus locking the functionality out and requiring physical access to restore.

...How long until homebrew firmware running on this, with a better non-laggy UI and more functionality? The hardware doesn't seem all that complex to work with.
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 12135
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #236 on: October 26, 2013, 11:17:51 am »
Can someone share files that are not included in the fw update pack? (gui and cmd)
I've not found a way to copy off .exe files - it doesn't let you copy to another drive or FTP - may try booting in safe mode to see if this helps. Would be good to know all the modes of usbfn as it would be handy to have RNDIS, MSD and UVC all working.

Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline Pinkus

  • Frequent Contributor
  • **
  • Posts: 650
Re: Flir E4 Thermal imaging camera teardown
« Reply #237 on: October 26, 2013, 11:33:25 am »
Quote
It has only been tested with Firmware V1.18.8 It seems likely that 1.18.7 may be also OK looking at the update files.
Just to let everybody know who is thinking about a purchase: the E4 I yesterday purchased online (and which just arrived) in Germany has Firmware 1.18.8. Hardware information says its "E4 1.0".
Unfortunately I cannot proceed now with the hack .... vacation time!
It has to wait now for a week..... can't wait to return to hack it.

But even in 80x60 mode I can say so far: due to MSX even this low res is quite useful, that was a clever idea from Flir.
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 12135
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #238 on: October 26, 2013, 01:09:19 pm »
It could be that those extra menus are triggered by the presence of a file (like the highres mode), which is put there at the factory and gets deleted afterwards - thus locking the functionality out and requiring physical access to restore.
Seems unlikely - at the factory they have a physical connection available so wouldn't need a way to configure via the keypad. I also doubt it would involve putting stuff on the user partition, as the settings could prevent access to this, though one possibility could be that it will only do it of it sees USB power.
Keeping it simple seems to me to be the most likely approach, not depending on anything that could be inaccessible under certain conditions
Quote
...How long until homebrew firmware running on this, with a better non-laggy UI and more functionality? The hardware doesn't seem all that complex to work with.
A possibility, but how much more functionality would there need to be to make it worth the effort? You'd also need to include their FPGA file, but if you left the factory filestructure in place, it would be in there anyway.
Assuming (as seems likely) the FPGA does most of the work and feeds a ready-to-display combined image into the camera interace it may not be a huge effort for someone who knows the processor. The main thing you'd need to figure out is how it talks to the FPGA and what data is passed  - likely to be an I2C or SPI interface.
A potential issue may be getting the bootloader to load foreign code.
There is also the issue of figuraing out how factory cal data is dealt with.

.so what other functionality might be useful...?
Higher framerate is the obvious one, though may need a bigger lens to be useful.
Higher temperature  resolution at lower framerate
Video recording, but memory capacity, and maybe CPU power for compression may be limiting.
Timelapse/ take pictured on motion detection (good for wildlife?)
Auto MSX distance detection ( may not have access to both datastreams though)
Some of these would be doable by plugging into PC/RasPi etc.

Not sure I can see it happenning.

Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Online PA0PBZ

  • Super Contributor
  • ***
  • Posts: 4342
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #239 on: October 26, 2013, 01:44:50 pm »
I unpacked NK.bin and have a zip file available to anyone interested (174 files, 4.4Mb zipped)

https://www.dropbox.com/s/g7ix9z3idp1zxsa/nk.zip

Keyboard error: Press F1 to continue.
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 12135
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #240 on: October 26, 2013, 02:21:53 pm »
Cool! has all the Windows files that it won't let me copy.
CMD.exe has some bitmaps inside, including an image of the command prompt - odd
autoloadcheck.exe has a FLIR logo - boot screen (startup or wake from sleep) perhaps
« Last Edit: October 26, 2013, 02:25:02 pm by mikeselectricstuff »
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline cartti

  • Newbie
  • Posts: 3
Re: Flir E4 Thermal imaging camera teardown
« Reply #241 on: October 26, 2013, 03:04:52 pm »
I unpacked NK.bin and have a zip file available to anyone interested (174 files, 4.4Mb zipped)

https://www.dropbox.com/s/g7ix9z3idp1zxsa/nk.zip
Thank you. These are from different model (mips processor), so ppl do not even try using these in E4. :)

Edit: Still missing GUI.exe tho, grr..  |O
« Last Edit: October 26, 2013, 03:13:32 pm by cartti »
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 12135
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #242 on: October 26, 2013, 03:35:53 pm »
I unpacked NK.bin and have a zip file available to anyone interested (174 files, 4.4Mb zipped)

https://www.dropbox.com/s/g7ix9z3idp1zxsa/nk.zip
Thank you. These are from different model (mips processor), so ppl do not even try using these in E4. :)

Edit: Still missing GUI.exe tho, grr..  |O
Are you sure - references to ASCO, and build date of September.
I don't have cam to hand to compare - will check later
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline cartti

  • Newbie
  • Posts: 3
Re: Flir E4 Thermal imaging camera teardown
« Reply #243 on: October 26, 2013, 03:56:47 pm »
I unpacked NK.bin and have a zip file available to anyone interested (174 files, 4.4Mb zipped)

https://www.dropbox.com/s/g7ix9z3idp1zxsa/nk.zip
Thank you. These are from different model (mips processor), so ppl do not even try using these in E4. :)

Edit: Still missing GUI.exe tho, grr..  |O
Are you sure - references to ASCO, and build date of September.
I don't have cam to hand to compare - will check later
# Format      : Portable executable for MIPS R4000 (PE)

Oh wait. Some of the files are for ARM and some for MIPS. CMD.exe and some .dll's were Mips that i looked through, but now after looking at some random other files they are for ARM.

Maybe fw installer just picks right files for right model or?...
« Last Edit: October 26, 2013, 04:02:09 pm by cartti »
 

Online PA0PBZ

  • Super Contributor
  • ***
  • Posts: 4342
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #244 on: October 26, 2013, 04:29:38 pm »
Not sure, but these are from the Z3comb_v1.18.7 I downloaded from the Flir web site as the update for Ex.
Keyboard error: Press F1 to continue.
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 12135
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #245 on: October 26, 2013, 04:47:37 pm »
Not sure, but these are from the Z3comb_v1.18.7 I downloaded from the Flir web site as the update for Ex.
I had an old ARM disassembler bork at E4 files complaining they weren't ARM - maybe  some confusion over processor ID headers somewhere.
What are you using to look at them & how old is it?
Will compare with installed files when I get home.
 
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Online PA0PBZ

  • Super Contributor
  • ***
  • Posts: 4342
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #246 on: October 26, 2013, 05:27:19 pm »
I looked at the cmd.exe COFF file header and yes, the machine type field (at offset 0xC4) says 0x166, that's MIPS for sure.
I checked a few others and they all have 0x166. I'm beginning to think that NK.bin has 2 sections and I unpacked the wrong section.

To be continued...

Keyboard error: Press F1 to continue.
 

Offline mrflibble

  • Super Contributor
  • ***
  • Posts: 2018
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #247 on: October 26, 2013, 05:35:11 pm »
I'm beginning to think that NK.bin has 2 sections and I unpacked the wrong section.

What did you use to extract from .bin?
 

Online PA0PBZ

  • Super Contributor
  • ***
  • Posts: 4342
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #248 on: October 26, 2013, 05:46:39 pm »
What did you use to extract from .bin?

I used NKtools, that seems to be the way to go. I don't think there is another section in the NK.bin, since the size is almost exactly the size of the extracted files, and I don't think there is any compression.

From camera.cmd (the update tool):

Code: [Select]
$LABEL checkinstallOS
dir /B \temp
[*OS*][$GOTO os]
$GOTO checkinstallOSEnd
$LABEL os
# Install OS here
# $SHOW "Updating OS"
delete nk.bin
delete nk.crc
delete gethwtype.exe
delete osimg.rev

#
#
addfile /nk.bin
addfile /nk.crc
## 70
#
kitcrc -c \nk.crc
[*FAIL*][$FAIL "Bad checksum on transferred OS",3]
$TIMEOUT 360
flash -l -n nk.bin
#
$LABEL checkinstallOSEnd

So it looks like they just flash the bin file, I'm puzzled  :-//
Keyboard error: Press F1 to continue.
 

Online PA0PBZ

  • Super Contributor
  • ***
  • Posts: 4342
  • Country: nl
Re: Flir E4 Thermal imaging camera teardown
« Reply #249 on: October 26, 2013, 06:10:13 pm »
Ok, so kernel.dll has the 0x166 signature for MIPS, but also has the text "Windows CE Kernel for ARM (Thumb Enabled) Built on May  7 2012 at 12:47:43".  :wtf:
Keyboard error: Press F1 to continue.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf