Flir E4 Thermal imaging camera teardown

[DaveWB]

Nope, I don't have any Mass Storage Device on any of my 3 Windows computers. At first I didn't know I should have one, but I guess I should Also, FlirNetTools says it cannot find a camera and doesn't show the USB Video like in your screenshot.

Ok... here a small checklist:
- be sure to install flir player (comes with drivers)
- try with alternative cable - they sometimes break!
- do not use USB hubs
- try different USB ports
- write down what OS and patchlevel did not recognize the camera
- visually inspect the socket (use magnifier)

I was helping someone on skype and they made the mistake of updating from 1.22 to 2.1 and they are having the same exact symptoms... its not even showing up on Flir Tools.

[Iphone_hack]

Been sitting on the sidelines reading up on this. Great work to you all.

Now for my tiny tiny contribution... considering that firmware 2.1 is out, just a serial number to tighten up the log.

My unit has version 1.22 on serial 63925XXX with calibration date of April 28th, so estimate the worldwide supply accordingly

Hi I want to contribute too
I am in canada

Bought mine first E4
On May 1st
Got it on 8th
Serial 63925xxx
Site Estonia
Date April 28, 2014
1.22.0
1.1L

Hope you guys can find a way to hack this new version
Thanks
Any news if this new version still have the same hardware ?

[realdoc]

Any news if this new version still have the same hardware ?

No, it has a new reivision, but due to the problems I have actually hooking it up to a computer, we cannot dump the files on there to analyze or try the IR sensor modifications.

I was helping someone on skype and they made the mistake of updating from 1.22 to 2.1 and they are having the same exact symptoms... its not even showing up on Flir Tools.

Okay,so that would mean my camera is not broken, that 1.2L is not proven broken yet, but the 2.1.0 firmware is causing this issue. Did you manage to resolve the issue with them?

- try with alternative cable - they sometimes break!
- do not use USB hubs
- try different USB ports
- visually inspect the socket (use magnifier)
- write down what OS and patchlevel did not recognize the camera

Already did those. I actually used 3 diferent computers. Windows 7 Ult x64, Windows 8.1 x86, Windows Vista SP2 x64 with FLIR tools 4.1.14066.1001 and driver 1.9.1.0.

- be sure to install flir player (comes with drivers)

That might be the missing link, I will try that right away

BTW, I also logged a support issue with FLIR about it. Let's see what they come up with.

[Taucher]

- be sure to install flir player (comes with drivers)

That might be the missing link, I will try that right away

Don't forget to install as Administrator (use right mouse button)

[ixfd64]

Don't know if it helps, but here is the direct link to the installer for the 2.1.0 firmware: http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_ex_pn639_v2.1.0_update_pack.zip

[Taucher]

Don't know if it helps, but here is the direct link to the installer: http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_ex_pn639_v2.1.0_update_pack.zip

That's the link to the most crippled update pack - IMHO nobody should use it.

This is the current PLAYER direct download link: http://support.flir.com/SwDownload/Assets/FLIR%20IR%20Camera%20Player/flir_ir_camera_player_2.3.3.exe

Other stuff: http://support.flir.com/SwDownload/App/SWDownload.aspx

[realdoc]

- be sure to install flir player (comes with drivers)

That might be the missing link, I will try that right away

Unfortunately, that did not work. The device drivers in the FLIR Player package are also the same 1.9.1.0 drivers as you can download seperately from the FLIR custhelp site.

It just feels like they upgraded the firmware but forgot to release new drivers.

[Taucher]

- be sure to install flir player (comes with drivers)

That might be the missing link, I will try that right away

Unfortunately, that did not work. The device drivers in the FLIR Player package are also the same 1.9.1.0 drivers as you can download seperately from the FLIR custhelp site.

It just feels like they upgraded the firmware but forgot to release new drivers.

What VID/PID string does the windows device manager show for the USB device?
Did you try factory resetting the E4?
Is the demo mode possibly enabled?
Does saving a picture by trigger and replaying it -in cam- work?
Edit: Did you try hard-resetting the cam (remove battery)

[realdoc]

What VID/PID string does the windows device manager show for the USB device?

Code: [Select]

kernel: usb 3-3: new high-speed USB device number 4 using xhci_hcd
kernel: usb 3-3: New USB device found, idVendor=09cb, idProduct=1007
kernel: usb 3-3: New USB device strings: Mfr=7, Product=8, SerialNumber=0
kernel: usb 3-3: Product: FLIR Ex-Series
kernel: usb 3-3: Manufacturer: FLIR Systems


Did you try factory resetting the E4?

Yes, I did. After that I also power-cycled it.

Is the demo mode possibly enabled?

No. And after resetting the camera to factory defaults, that should be gone anyway I guess.

Does saving a picture by trigger and replaying it -in cam- work?

Yes, that works. I can also display the taken picture, as long as USB is not connected.

Edit: Did you try hard-resetting the cam (remove battery)

Yes, multiple times.

The strange thing is that the Mass Storage seems to work in Linux, but on none of my Windows machines,not even freshly installed ones. That really leaves me puzzled.

Are my PID/VID the same as yours? What OS / Patch Level / FLIR tools version are you running? I will then reproduce the exact same scenario and try again.

[Taucher]

What VID/PID string does the windows device manager show for the USB device?

Code: [Select]

kernel: usb 3-3: new high-speed USB device number 4 using xhci_hcd
kernel: usb 3-3: New USB device found, idVendor=09cb, idProduct=1007
kernel: usb 3-3: New USB device strings: Mfr=7, Product=8, SerialNumber=0
kernel: usb 3-3: Product: FLIR Ex-Series
kernel: usb 3-3: Manufacturer: FLIR Systems


Please hit WIN+PAUSE under windows and navigate to device manager -> please post a screenshot showing all unknown devices listed there - my best guess would be you're missing the lower-level USB drivers or you have some strange security software running (upper or lower filters)

The VID/PID combo changes depending on selected mode - can somebody pls. fetch the table from our archives? ... see below for details

[Taucher]

Found it...

Code: [Select]

MSD                   : 09cb:ffff
UVC                   : 09cb:1004
RNDIS                 : 09cb:1002
RNDIS and UVC         : 09cb:1005
RNDIS and MSD         : 09cb:1006
UVC and MSD (standard): 09cb:1007 <<<
RNDIS, UVC and MSD    : 09cb:1005

Note: RNDIS, UVC and MSD   is known not to work... but that won't affect you - your E4 is still in default mode!

[realdoc]

Please hit WIN+PAUSE under windows and navigate to device manager -> please post a screenshot showing all unknown devices listed there - my best guess would be you're missing the lower-level USB drivers or you have some strange security software running (upper or lower filters)

The only thing there is an Imaging Device with an exclamation mark called "FLIR Ex-Series". There is no Mass Storage Device, nor nothing else with exclamation marks.

[Taucher]

The only thing there is an Imaging Device with an exclamation mark called "FLIR Ex-Series". There is no Mass Storage Device, nor nothing else with exclamation marks.

Thats what I've expected - driver is not installed or not working.
Doubleclick that device and read/copy the explanation why it does not work (driver, not working properly etc)
-> maybe try install driver and if requested select the driver directory...

[realdoc]

Thats what I've expected - driver is not installed or not working.
Doubleclick that device and read/copy the explanation why it does not work (driver, not working properly etc)
-> maybe try install driver and if requested select the driver directory...

Which driver are you using? I tried all of them in the Device Drivers folder, but they all result in a BSOD (blue screen of death).

[Taucher]

Which driver are you using? I tried all of them in the Device Drivers folder, but they all result in a BSOD (blue screen of death).

How about supplying some helpful data like BSOD message code (take it from syslog)...

[JFA]

New problem on E4 1.1L  v1.22.0

The camera started to become erratic. I had a WinCE error (which I didn't note down).

Eventually, the up button would not work anymore.

I did a factory reset, cold boot, removed the improved menus, removed the res improve and I am now back to the stock E4.

The up-button on the paddle does not work. I cannot access emissivity controls anymore, unless I do a factory reset. Every time I go down into the config menu, I must do a factory reset to go to the top again.

I will try to return the unit, as it seems to be hardware-related.  Hopefully, I'll get a 1.22 back
Any comment?

[realdoc]

How about supplying some helpful data like BSOD message code (take it from syslog)...

I went through all the installed drivers for the video and they are all ment for a firewire thermalcam, so that might well be why they result in a BSOD. Unfortunately I have to leave home for work the upcoming week, so I cannot troubleshoot anything until next Friday. I let you guys know if I get any response from FLIR on my ticket tho

Thanks so far!!

[joe-c]

Whatever you want. Tomorrow. Send a PM with your E-Mail to me. You will get the file.

the best of all (1.19. could never been downloaded, right?

[tom66]

Damn, I start work in July. I sure hope the Lepton E4 isn't out by then, because I'll finally be able to afford a proper E4 to upgrade. Otherwise FLIR will lose any prospect of money from me.

They should just make it so you can upgrade but it embeds a small watermark "Unauth. Upgrade" - that prevents professional users from using it (probably what they are most concerned about) - whilst allowing other non-pros to use it.

[realdoc]

They should just make it so you can upgrade but it embeds a small watermark "Unauth. Upgrade"

This is not a good idea.
It seems at the moment to be already too late, as currently the E4 is already delivered with the new FW 2.1.0. There is as yet no indication of a successful hack.

But on the bright side, there are also no signs of an unsuccesful hack. attempt The 2.1.0 sw and 1.2L hw are just very new and so far I seem to be the only one having them. Let's hope FLIR can fix the driver issues I experience, so I can hook my Ex up to FLIR Tools and see what happens   Just being able to transfer the pictures would be cool already haha.

Looking at the 2.1.0 firmware, it's still a WinCE environment with some magic, but the executables don't seem to be overly protected. The worst case would be that we would have to change our attack vector from the checksummed cfc file to the appcore.exe binary and dll, to change variables or prevent security checks from raising exceptions.

[Fraser]

@realdoc.

I know it would not help this community but in your position I would be looking at returning your E4 for a refund as it is not fit for purpose due to the FLIR Tool connectivity issue. I would then put my efforts into finding an E4 with version 1.22 or earlier firmware. They are still available if you look around. There is the very real possibility that FLIR have done a decent job of locking down the platform this time. Nothing is unhackable if it has an I/O port BUT it may take a great deal of effort to succeed this time and such relies on 'others' having the time to assist. The fact that the E4 no longer communicates with its OEM software may even be an indicator of how locked down the new firmware is. As I have stated, an open I/O port is a vulnerability and FLIR know it. There are ways to ensure that a platform will only provide limited connectivity via its external ports and only to a specific application that is in itself locked down to prevent its easy use as an attack vector.

FLIR read this forum and will be learning from the conversations that occur here. If you wish to take the risk that they have missed an attack vector in their latest release then stick with it, but they have had plenty of time to perfect their defensive strategy and that new hardware revision makes me think they may have advanced to combined firmware and hardware lock downs. I may be totally wrong but while there are still older firmware cameras available, I would make life easier for myself and get one of those while you have the good treason to return your 2.1.0 camera.

Just my 5 Cents worth.

[pciebiera]

FYI E4 ordered from Amazon US on May 30, 2014 arrived June 2, 2014 has firmware 1.22.

[oddy992]

Ok so I have been following progress on the hack for a while and took the plunge to find out I've got an e4 with the new firmware!

I'm having the same issue putting it into RNDIS mode, I can get to the menu and then select it but it never actually changes mode.

Oddly I'm not having driver issues as stated, I can view the camera video using Flir player.exe etc.

Any tricks I can try to get the camera to respond in RNDIS? Happy to provide any details necessary.

[ixfd64]

I wouldn't be surprised if FLIR deliberately disabled RNDIS mode to hamper the hack.

[Fraser]

The camera will likely still have an I/O port that is open for calibration tasks so it is unlikely to be totally locked down but activation may require either a 'secret' key sequence or the correct 'Open Sesame' command from a host computer. There are so many ways to slam the door shut on users by denying them the attack vectors that are needed to 'probe' the OS and firmware. Sadly when a manufacturer goes for a nice tight lock-down, you often have to move from a close case, to open case hack involving direct access to key chips in the system. There is the RS232 port on the motherboard but FLIR know that this was discovered and exploited by Mike. It may end up with someone having to open their new E4 to see what, if anything, has changed since HW 1.0 and 1.1L. It would be a real shocker to see a LEPTON core sat where once a 320x240 microbolometer had resided ! Panic not, it's unlikely that this has been done. The FPGA config files are what would worry me. As others have stated, reverse engineering an FPGA is not a real option and so any countermeasure that involved the FPGA could be very effective.