Poll

Has the hackabiliy of the E4 made you buy one :  

Yes, I was already looking at the competition at a similar price, but the hack swung it to E4
241 (26.5%)
Yes, I'd not considered buying a TIC before, but 320x240 resolution at this price justifies it (as either tool or toy!)
427 (46.9%)
Yes, I was going to buy an E5/6/8 class of unit but will now get the E4
43 (4.7%)
No, but am looking out for a cheap i3 to hack
42 (4.6%)
Not yet, but probably will if now that a closed-box hack becomes is possible
158 (17.3%)

Total Members Voted: 751

Author Topic: Flir E4 Thermal imaging camera teardown  (Read 2669947 times)

0 Members and 4 Guests are viewing this topic.

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 12003
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #3475 on: February 06, 2014, 04:24:38 pm »
I still do not understand where exactly is the problem. When you will receive 1.21, you can connect to it via FTP, erase complete FLASH and copy 1.19 there. Or am I wrong ? You can see all the appcore.exe and other files, so I expect you can overwrite it with previous version. Sounds so simple.

In fact I did hack the same way. I did not use fif and installator. I just copied config file via FTP.
FTP will only work if you can enable RNDIS.

They may have changed the cal data format so cal data from a later unit won't be understood by 1.19.
Anyone checked if the FPGA code has changed?
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Online Fraser

  • Super Contributor
  • ***
  • Posts: 8548
  • Country: gb
Re: Flir E4 Thermal imaging camera teardown
« Reply #3476 on: February 06, 2014, 04:31:03 pm »
Taucher indicated that te fw 1.21.0 FPGA program was very different, but that this may not be an issue as small changes in FPGA config cause large changes in FPGA program. I am not familiar with FPGA programming though. My only thought was that FLIR are locking down the FPGA to prevent fps hacking. If so, the E4's that we own may indeed have a fps vulnerablity. Remeber that report I received and commented to you by PM ?  ;)
« Last Edit: February 06, 2014, 04:34:13 pm by Aurora »
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 12003
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #3477 on: February 06, 2014, 04:49:54 pm »
Taucher indicated that te fw 1.21.0 FPGA program was very different, but that this may not be an issue as small changes in FPGA config cause large changes in FPGA program. I am not familiar with FPGA programming though. My only thought was that FLIR are locking down the FPGA to prevent fps hacking. If so, the E4's that we own may indeed have a fps vulnerablity. Remeber that report I received and commented to you by PM ?  ;)
You can't infer much from the amount of difference, just that it was different. I can't think of a reason why FPGA code would change to improve hack security other than if there was a fps vuln, however as the FPGA does a lot of signal processing, it's entirely possible that this could have been tweaked to improve performance of for other reasons. 

However it's not out of the question that they could have moved part of some critical function like CRC checking or code signing into the FPGA to make it a  lot harder to reverse-engineer from the code.
« Last Edit: February 06, 2014, 04:51:49 pm by mikeselectricstuff »
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline Bolt

  • Newbie
  • Posts: 3
  • Country: 00
Re: Flir E4 Thermal imaging camera teardown
« Reply #3478 on: February 06, 2014, 05:00:18 pm »
I have 1.19.8 with all the enhancements here, and it

1) crashes several times with "appcore error" right after boot, in case it turned itself from standby to off previously. Example - use the camera, turn it off (standby), leave it 14 days untouched, it will turn itself to off in meantime. After boot appcore error appears.

2) sometimes freezes while working. It can freeze softly with some mess, noise, ghost, squares on screen. Or It can freeze hardly into black screen. Both needs battery remove. After power on it is ok. Always happened to me under freezing temperatures, never above 0°C.

Both time by time, not frequently.

I can confirm both.
I confirm too, happened after one-two days untouched (1) or after cooling (2), and after removing battery works ok.

Today it's happened again, and i try "to freeze" (outdoor temp was -10...-15 C). After turn on i see gray squares on startup, blue background instead IR image, measuring crossbar at upleft corner, and some other malfunction. Removing battery not helps. It turned out, file calib.rsc damaged, some binary data inside of text. Maybe other files too, but after restoring file from backup all works.

(sorry for my english)
 

Online Fraser

  • Super Contributor
  • ***
  • Posts: 8548
  • Country: gb
Re: Flir E4 Thermal imaging camera teardown
« Reply #3479 on: February 06, 2014, 05:26:04 pm »
What version hardware is involved with these crashes and what Taucher Menu version is installed ?
 

Offline daves

  • Regular Contributor
  • *
  • Posts: 103
  • Country: cz
Re: Flir E4 Thermal imaging camera teardown
« Reply #3480 on: February 06, 2014, 05:29:11 pm »
What version hardware is involved with these crashes and what Taucher Menu version is installed ?

1.0, menu 3 with zoom
Batch Thermal Images Editor (JPG, BMT, SNP, IRI, ISI, IS2, PGM, TIF, IMG, BMP):  https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg350556/#msg350556
 

Offline araugh

  • Contributor
  • Posts: 8
Re: Flir E4 Thermal imaging camera teardown
« Reply #3481 on: February 06, 2014, 05:32:56 pm »
received mine today, shipped from the lot that TEquipment got yesterday.  Serial number 639136**, Firmware 1.19.8, Calibration date January 29th, 2014


EDIT: Added calibration date
« Last Edit: February 06, 2014, 09:07:18 pm by araugh »
 

Offline tomas123

  • Frequent Contributor
  • **
  • Posts: 832
  • Country: de
Re: Flir E4 Thermal imaging camera teardown
« Reply #3482 on: February 06, 2014, 05:42:30 pm »
there are only 2 points, where Flir can differ a E4 from a E8 while updating:
  • the master config file with old crc check in flashfs\system\appcore.d\config.d\ and some entries in GUI files
  • the eeprom entry

both points are hacked but who have the courage to update their E4+ ?  >:D

let's see whether the new firmware has an open (root) FTP access or the internal server accept any *.fif files from FLIRInstallNet 
« Last Edit: February 06, 2014, 05:45:51 pm by tomas123 »
 

Offline olsenn

  • Frequent Contributor
  • **
  • Posts: 993
Re: Flir E4 Thermal imaging camera teardown
« Reply #3483 on: February 06, 2014, 05:47:13 pm »
FLIR could have stopped this much earlier if they wanted to. They waited until the sales slowed down, then pulled the trigger
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 12003
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #3484 on: February 06, 2014, 05:53:17 pm »
there are only 2 points, where Flir can differ a E4 from a E8 while updating:
  • the master config file with old crc check in flashfs\system\appcore.d\config.d\ and some entries in GUI files
  • the eeprom entry

both points are hacked but who have the courage to update their E4+ ?  >:D

let's see whether the new firmware has an open (root) FTP access or the internal server accept any *.fif files from FLIRInstallNet
Calibration data?
Model encoding in serial number?

Not that there would be any reason to try, but it would be interesting to see if applying the update to a hacked E4 preserved the hackeness.
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 12003
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #3485 on: February 06, 2014, 05:55:48 pm »
FLIR could have stopped this much earlier if they wanted to. They waited until the sales slowed down, then pulled the trigger

Except we haven't seen any evidence yet that the trigger has actually been pulled, i.e. new FW in production units. They've just taken the safety off... :D

BTW are there any indications of software build dates in the new FW?
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline tiagobaracho

  • Regular Contributor
  • *
  • Posts: 66
Re: Flir E4 Thermal imaging camera teardown
« Reply #3486 on: February 06, 2014, 06:23:10 pm »
guys... i was looking for a IR camera and got to this thread an after reading few pages... i see a need in hurry to buy to be able to hack....
Can anyone tell me exacly what do  gain with the hacking ? is it FPS or resolution upgrades?
Thanks a lot
 

Offline dtbp

  • Contributor
  • Posts: 12
Re: Re: Flir E4 Thermal imaging camera teardown
« Reply #3487 on: February 06, 2014, 06:26:58 pm »

Except we haven't seen any evidence yet that the trigger has actually been pulled, i.e. new FW in production units. They've just taken the safety off... :D

I was just about to say the same thing. Hopefully they hold off or at least give the distributors plenty of time to modify their orders so they aren't stuck with 80 units nobody wants or returns after checking the firmware.
 

Offline tiagobaracho

  • Regular Contributor
  • *
  • Posts: 66
Re: Flir E4 Thermal imaging camera teardown
« Reply #3488 on: February 06, 2014, 06:30:27 pm »
I just had this conversation with the sales department. What do you think ? new version or older ? When was released the new firm
ware ?
[Tequipment] How can I help you today?
[Tiagobaracho] hi
[Tiagobaracho] I want to get one FLIR E4 Thermal Imager with MSX Technology 80 × 60 (4,800 Pixels)
[Tiagobaracho] but i need to know wich firmware version you have in stock... how can i know that ?
[Tequipment] Any units we have in stock would have the latest firmware available.
[Tiagobaracho] we.. it was just released a new firmware.... and i want with the older firmware.... but maybe your stock have the old one
[Tequipment] One moment, please while I check on that for you.
[Tiagobaracho] its important to my decision..
[Tequipment] we have no idea what version firmware is on our units
[Tiagobaracho] someone on stock department can give this info /?
[Tequipment] no..firmware info is on the camera itself..we do not open boxes..we ship our cameras in unopeneed boxes
[Tiagobaracho] can you tell at least how long ago arrived the stock you have today for sale ?
[Tequipment] a week ago
 

Offline dtbp

  • Contributor
  • Posts: 12
Re: Re: Flir E4 Thermal imaging camera teardown
« Reply #3489 on: February 06, 2014, 06:37:08 pm »
guys... i was looking for a IR camera and got to this thread an after reading few pages... i see a need in hurry to buy to be able to hack....
Can anyone tell me exacly what do  gain with the hacking ? is it FPS or resolution upgrades?
Thanks a lot

Resolution only. From 80x60 to 320x240 thermal resolution. The fps will remain at 9. The Taucher menu adjustment adds nice functionality from the E8 and Exx cameras.

It is well worth the enhancement and is quite easy to do without damaging the device, provided you get the old firmware...
 

Offline araugh

  • Contributor
  • Posts: 8
Re: Flir E4 Thermal imaging camera teardown
« Reply #3490 on: February 06, 2014, 06:41:13 pm »
Hack was successful and extremely simple.  thank you so much for making this a viable tool, even at 80x60 is was a good deal, but at 320x240 I'd have gladly paid double, and I wasn't really in the market for a TIC before.
 

Offline tiagobaracho

  • Regular Contributor
  • *
  • Posts: 66
Re: Re: Flir E4 Thermal imaging camera teardown
« Reply #3491 on: February 06, 2014, 06:43:11 pm »
guys... i was looking for a IR camera and got to this thread an after reading few pages... i see a need in hurry to buy to be able to hack....
Can anyone tell me exacly what do  gain with the hacking ? is it FPS or resolution upgrades?
Thanks a lot

Resolution only. From 80x60 to 320x240 thermal resolution. The fps will remain at 9. The Taucher menu adjustment adds nice functionality from the E8 and Exx cameras.

It is well worth the enhancement and is quite easy to do without damaging the device, provided you get the old firmware...
thats great..... !!
In which latest firmware It can be done  ?
 

Offline daves

  • Regular Contributor
  • *
  • Posts: 103
  • Country: cz
Re: Re: Flir E4 Thermal imaging camera teardown
« Reply #3492 on: February 06, 2014, 06:52:25 pm »
In which latest firmware It can be done  ?

Please read first post on page 1, there is many interesting info you would probably need. 1.19.8 is the last one.

I just had this conversation with ... [Tequipment]

Well they did not help me neither. Finally I bought from PASS.

Anyway, someone here just bought from them and it was 1.19.8. They can also give you serial number (it is on box), so you can see if it could be old firmware.

See:
received mine today, shipped from the lot that TEquipment got yesterday.  Serial number 639136**, Firmware 1.19.8
« Last Edit: February 06, 2014, 06:56:36 pm by daves »
Batch Thermal Images Editor (JPG, BMT, SNP, IRI, ISI, IS2, PGM, TIF, IMG, BMP):  https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg350556/#msg350556
 

Online Fraser

  • Super Contributor
  • ***
  • Posts: 8548
  • Country: gb
Re: Flir E4 Thermal imaging camera teardown
« Reply #3493 on: February 06, 2014, 08:53:42 pm »
News from PASS (UK) regarding stock....

I have heard back from David at PASS:


Good afternoon xxxxxxxxxxxx


Again thanks for the heads up,

We are pleased to say that we have just received 35 x E4, which are still at the old firmware 1.19.8. These are going very very quick and we only have 18 units left.

I’m more than happy for you to tell people to contact me directly 01642 626142 as always.

Many thanks

David Atkins – Senior Account Manager
Certified Level 1 Infrared Thermographer
Test Equipment & Thermal Camera Sales

Tel: 01642 626142 (Direct Line)

Fax: 0870 143 1869

Mobile: 07792 742265

Email: dave@tester.co.uk


Get them while he has 'old' stock !
 

Offline Taucher

  • Frequent Contributor
  • **
  • Posts: 456
  • Country: de
  • 1DsaYDGWXEYhEKL rfrbFyYsehaAtfBWawf
Re: Flir E4 Thermal imaging camera teardown
« Reply #3494 on: February 06, 2014, 09:24:51 pm »

First - regarding the 1.21.0 firmware I get the strong feeling that I2C is the major reason for the changes.
My strong impression is, that the HW detection solely depends on I2C data - where the basic factory config (hardware, sensor version) got saved (T# stuff).
That's why I can imagine the new "truck charger" driver is not what it seems to be but might be some kind of eeprom-lockdown module.

Mike - any chance for some x-ray images of the Ex-battery?



Before I forget them, here some memos from the last "binary inspection" run :)

Userlist:
   zorro
   anto9
   default
   flir
   3vlig
   root

VERIFIED (UserList is always: flir:3vlig):

   Services\SMBServer\Shares\Bin$      = \FlashBFS -> \\192.168.0.2\Bin$\system
   Services\SMBServer\Shares\Root$     = \FlashFS  -> \\192.168.0.2\Root$
   Services\SMBServer\Shares\images    = \FlashIFS -> \\192.168.0.2\images
   Services\SMBServer\Shares\windows$  = \Windows  -> \\192.168.0.2\windows$
   Services\SMBServer\Shares\temp      = \Temp     -> \\192.168.0.2\temp

WEBSERVER:
Comm\HTTPD\VROOTS\/Ram  = \Temp\   
-> http://192.168.0.2/Ram/ <- requested action forbidden (INDEX), but file-access works:
Example: http://192.168.0.2/Ram/postlog.txt

Comm\HTTPD\VROOTS\/Tmp = \FlashFS\tmp\
-> http://192.168.0.2/Tmp/ (index forbidden, but files accessible)

Comm\HTTPD\VROOTS\/service = \FlashBFS\system\web\service\ (UserList: flir)
-> http://192.168.0.2/service/ -> Service menu

Comm\HTTPD\VROOTS\/Prod = \FlashBFS\system\prodisapi.dll
--> http://192.168.0.2/Prod --> The server encountered an error.

Comm\HTTPD\VROOTS\/, = \FlashBFS\system\web\
-> http://192.168.0.2/ -> Service menu startpage
   
----------------
Other findings:


Restore registry from \Windows\default.fdf
Restore registry from \Windows\Drestore.fdf

\Temp\AutoTempAbsolute\
\Temp\Autosave\
\FlashFS\System\
\FlashFS\System\default_a\
default*.rsc
\FlashFS\System\default_b\
\FlashFS\System\initial.rsc
\FlashFS\System\default_a\initial.rsc
\FlashFS\System\default_b\initial.rsc
\FlashFS\System\ProgressAppLegal.dat

httpd:
AdminUsers
ADMIN
Basic


on first connect the driver assigns a different IP to my PC:
192.168.0.3 / 255.255.255.0 + 192.168.250.3 / 255.255.255.0

Autoload-stuff:
autoload.fif
"SOFTWARE\FLIR Systems\Applauncher
>LaunchFileAlt
\FlashBFS\system\applaunch.dat
eFLIRInstall.exe
,ContinueFile
eFLIRInstall_cont.dat

Offline tiagobaracho

  • Regular Contributor
  • *
  • Posts: 66
Re: Flir E4 Thermal imaging camera teardown
« Reply #3495 on: February 06, 2014, 09:52:53 pm »
just bought from tequipment using EEVBLOG6 discount code and with overnight shipping  :D
I REALLY hope to get a 1.19.8...... as a friend here from this thread...
Now i will search for the steps to hack it here.
Thanks guys
 

Offline tiagobaracho

  • Regular Contributor
  • *
  • Posts: 66
Re: Flir E4 Thermal imaging camera teardown
« Reply #3496 on: February 06, 2014, 10:14:32 pm »
is it a possibility in the future to be able to get higher FPS ? or is it the sensor that only can make 9 fps ?... just out of curiosity ..
Its funny.. i bout a DS2072a osciloscope that came with 70mhz... a hack in this forum made it go to 300mhz and few other functions , exactly as the 300 mhz model that costs 2570 usd. Now i bought one E4 for 988 and will get E8 in the end  that costs almost 6000 USD ?
Got to say.. this forum is great !
After the hack, is there anything different from the E8 ? or is it exactly the same ?
Thanks
 

Offline daves

  • Regular Contributor
  • *
  • Posts: 103
  • Country: cz
Re: Flir E4 Thermal imaging camera teardown
« Reply #3497 on: February 06, 2014, 10:17:07 pm »
After the hack, is there anything different from the E8 ? or is it exactly the same ?
It has more features than E8. I suggest you to visit first page ;-)
Batch Thermal Images Editor (JPG, BMT, SNP, IRI, ISI, IS2, PGM, TIF, IMG, BMP):  https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg350556/#msg350556
 

Offline Taucher

  • Frequent Contributor
  • **
  • Posts: 456
  • Country: de
  • 1DsaYDGWXEYhEKL rfrbFyYsehaAtfBWawf
Re: Flir E4 Thermal imaging camera teardown
« Reply #3498 on: February 06, 2014, 10:18:27 pm »
After the hack, is there anything different from the E8 ? or is it exactly the same ?
It has more features than E8. I suggest you to visit first page ;-)
But you don't get the additional battery and the front-label still says "E4" ;)

Offline tomas123

  • Frequent Contributor
  • **
  • Posts: 832
  • Country: de
Re: Flir E4 Thermal imaging camera teardown
« Reply #3499 on: February 06, 2014, 10:21:54 pm »

Before I forget them, here some memos from the last "binary inspection" run :)

WEBSERVER:

Comm\HTTPD\VROOTS\/service = \FlashBFS\system\web\service\ (UserList: flir)
-> http://192.168.0.2/service/ -> Service menu

Comm\HTTPD\VROOTS\/Prod = \FlashBFS\system\prodisapi.dll
--> http://192.168.0.2/Prod --> The server encountered an error.

I think you mean the old firmware.
in FW 1.21 there is no ProdISAPI.dll and folder \FlashBFS\system\web\service\


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf