Poll

Has the hackabiliy of the E4 made you buy one :  

Yes, I was already looking at the competition at a similar price, but the hack swung it to E4
274 (27.9%)
Yes, I'd not considered buying a TIC before, but 320x240 resolution at this price justifies it (as either tool or toy!)
444 (45.3%)
Yes, I was going to buy an E5/6/8 class of unit but will now get the E4
49 (5%)
No, but am looking out for a cheap i3 to hack
50 (5.1%)
Not yet, but probably will if now that a closed-box hack becomes is possible
164 (16.7%)

Total Members Voted: 803

Author Topic: Flir E4 Thermal imaging camera teardown  (Read 3770290 times)

0 Members and 6 Guests are viewing this topic.

Offline DaveWB

  • Regular Contributor
  • *
  • Posts: 146
Re: Flir E4 Thermal imaging camera teardown
« Reply #5000 on: June 01, 2014, 03:25:04 am »
Nope, I don't have any Mass Storage Device on any of my 3 Windows computers. At first I didn't know I should have one, but I guess I should :) Also, FlirNetTools says it cannot find a camera and doesn't show the USB Video like in your screenshot.

Ok... here a small checklist:
- be sure to install flir player (comes with drivers)
- try with alternative cable - they sometimes break!
- do not use USB hubs
- try different USB ports
- write down what OS and patchlevel did not recognize the camera
- visually inspect the socket (use magnifier)
I was helping someone on skype and they made the mistake of updating from 1.22 to 2.1 and they are having the same exact symptoms... its not even showing up on Flir Tools.
 

Offline Iphone_hack

  • Contributor
  • Posts: 43
Re: Flir E4 Thermal imaging camera teardown
« Reply #5001 on: June 01, 2014, 03:50:21 am »
Been sitting on the sidelines reading up on this. Great work to you all.

Now for my tiny tiny contribution... considering that firmware 2.1 is out, just a serial number to tighten up the log.

My unit has version 1.22 on serial 63925XXX with calibration date of April 28th, so estimate the worldwide supply accordingly :)

Hi I want to contribute too
I am in canada

Bought mine first E4
On May 1st
Got it on 8th
Serial 63925xxx
Site Estonia
Date April 28, 2014
1.22.0
1.1L

Hope you guys can find a way to hack this new version
Thanks
Any news if this new version still have the same hardware ?

 

Offline realdoc

  • Contributor
  • Posts: 26
Re: Flir E4 Thermal imaging camera teardown
« Reply #5002 on: June 01, 2014, 07:30:59 am »

Any news if this new version still have the same hardware ?
No, it has a new reivision, but due to the problems I have actually hooking it up to a computer, we cannot dump the files on there to analyze or try the IR sensor modifications.

I was helping someone on skype and they made the mistake of updating from 1.22 to 2.1 and they are having the same exact symptoms... its not even showing up on Flir Tools.
Okay,so that would mean my camera is not broken, that 1.2L is not proven broken yet, but the 2.1.0 firmware is causing this issue. Did you manage to resolve the issue with them?

- try with alternative cable - they sometimes break!
- do not use USB hubs
- try different USB ports
- visually inspect the socket (use magnifier)
- write down what OS and patchlevel did not recognize the camera
Already did those. I actually used 3 diferent computers. Windows 7 Ult x64, Windows 8.1 x86, Windows Vista SP2 x64 with FLIR tools 4.1.14066.1001 and driver 1.9.1.0.

- be sure to install flir player (comes with drivers)
That might be the missing link, I will try that right away :)

BTW, I also logged a support issue with FLIR about it. Let's see what they come up with.
« Last Edit: June 01, 2014, 07:40:46 am by realdoc »
 

Offline Taucher

  • Frequent Contributor
  • **
  • Posts: 456
  • Country: de
  • 1DsaYDGWXEYhEKL rfrbFyYsehaAtfBWawf
Re: Flir E4 Thermal imaging camera teardown
« Reply #5003 on: June 01, 2014, 07:37:05 am »
- be sure to install flir player (comes with drivers)
That might be the missing link, I will try that right away :)
Don't forget to install as Administrator (use right mouse button)

Offline ixfd64

  • Frequent Contributor
  • **
  • Posts: 345
  • Country: us
    • Facebook
Re: Flir E4 Thermal imaging camera teardown
« Reply #5004 on: June 01, 2014, 07:38:53 am »
Don't know if it helps, but here is the direct link to the installer for the 2.1.0 firmware: http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_ex_pn639_v2.1.0_update_pack.zip
« Last Edit: June 01, 2014, 04:37:03 pm by ixfd64 »
 

Offline Taucher

  • Frequent Contributor
  • **
  • Posts: 456
  • Country: de
  • 1DsaYDGWXEYhEKL rfrbFyYsehaAtfBWawf
Re: Flir E4 Thermal imaging camera teardown
« Reply #5005 on: June 01, 2014, 07:42:30 am »
Don't know if it helps, but here is the direct link to the installer: http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_ex_pn639_v2.1.0_update_pack.zip
That's the link to the most crippled update pack - IMHO nobody should use it.

This is the current PLAYER direct download link: http://support.flir.com/SwDownload/Assets/FLIR%20IR%20Camera%20Player/flir_ir_camera_player_2.3.3.exe

Other stuff: http://support.flir.com/SwDownload/App/SWDownload.aspx
« Last Edit: June 01, 2014, 07:45:28 am by Taucher »
 

Offline realdoc

  • Contributor
  • Posts: 26
Re: Flir E4 Thermal imaging camera teardown
« Reply #5006 on: June 01, 2014, 08:26:51 am »
- be sure to install flir player (comes with drivers)
That might be the missing link, I will try that right away :)
Unfortunately, that did not work. The device drivers in the FLIR Player package are also the same 1.9.1.0 drivers as you can download seperately from the FLIR custhelp site.

It just feels like they upgraded the firmware but forgot to release new drivers.
 

Offline Taucher

  • Frequent Contributor
  • **
  • Posts: 456
  • Country: de
  • 1DsaYDGWXEYhEKL rfrbFyYsehaAtfBWawf
Re: Flir E4 Thermal imaging camera teardown
« Reply #5007 on: June 01, 2014, 08:32:52 am »
- be sure to install flir player (comes with drivers)
That might be the missing link, I will try that right away :)
Unfortunately, that did not work. The device drivers in the FLIR Player package are also the same 1.9.1.0 drivers as you can download seperately from the FLIR custhelp site.

It just feels like they upgraded the firmware but forgot to release new drivers.

What VID/PID string does the windows device manager show for the USB device?
Did you try factory resetting the E4?
Is the demo mode possibly enabled?
Does saving a picture by trigger and replaying it -in cam- work?
Edit: Did you try hard-resetting the cam (remove battery)

Offline realdoc

  • Contributor
  • Posts: 26
Re: Flir E4 Thermal imaging camera teardown
« Reply #5008 on: June 01, 2014, 08:53:25 am »
Quote
What VID/PID string does the windows device manager show for the USB device?
Code: [Select]
kernel: usb 3-3: new high-speed USB device number 4 using xhci_hcd
kernel: usb 3-3: New USB device found, idVendor=09cb, idProduct=1007
kernel: usb 3-3: New USB device strings: Mfr=7, Product=8, SerialNumber=0
kernel: usb 3-3: Product: FLIR Ex-Series
kernel: usb 3-3: Manufacturer: FLIR Systems

Quote
Did you try factory resetting the E4?
Yes, I did. After that I also power-cycled it.

Quote
Is the demo mode possibly enabled?
No. And after resetting the camera to factory defaults, that should be gone anyway I guess.

Quote
Does saving a picture by trigger and replaying it -in cam- work?
Yes, that works. I can also display the taken picture, as long as USB is not connected.

Quote
Edit: Did you try hard-resetting the cam (remove battery)
Yes, multiple times.

The strange thing is that the Mass Storage seems to work in Linux, but on none of my Windows machines,not even freshly installed ones. That really leaves me puzzled.

Are my PID/VID the same as yours? What OS / Patch Level / FLIR tools version are you running? I will then reproduce the exact same scenario and try again.
 

Offline Taucher

  • Frequent Contributor
  • **
  • Posts: 456
  • Country: de
  • 1DsaYDGWXEYhEKL rfrbFyYsehaAtfBWawf
Re: Flir E4 Thermal imaging camera teardown
« Reply #5009 on: June 01, 2014, 09:31:24 am »
Quote
What VID/PID string does the windows device manager show for the USB device?
Code: [Select]
kernel: usb 3-3: new high-speed USB device number 4 using xhci_hcd
kernel: usb 3-3: New USB device found, idVendor=09cb, idProduct=1007
kernel: usb 3-3: New USB device strings: Mfr=7, Product=8, SerialNumber=0
kernel: usb 3-3: Product: FLIR Ex-Series
kernel: usb 3-3: Manufacturer: FLIR Systems

Please hit WIN+PAUSE under windows and navigate to device manager -> please post a screenshot showing all unknown devices listed there - my best guess would be you're missing the lower-level USB drivers or you have some strange security software running (upper or lower filters)

The VID/PID combo changes depending on selected mode - can somebody pls. fetch the table from our archives? ... see below for details
« Last Edit: June 01, 2014, 09:55:40 am by Taucher »
 

Offline Taucher

  • Frequent Contributor
  • **
  • Posts: 456
  • Country: de
  • 1DsaYDGWXEYhEKL rfrbFyYsehaAtfBWawf
Re: Flir E4 Thermal imaging camera teardown
« Reply #5010 on: June 01, 2014, 09:53:26 am »
Found it...
Code: [Select]
MSD                   : 09cb:ffff
UVC                   : 09cb:1004
RNDIS                 : 09cb:1002
RNDIS and UVC         : 09cb:1005
RNDIS and MSD         : 09cb:1006
UVC and MSD (standard): 09cb:1007 <<<
RNDIS, UVC and MSD    : 09cb:1005

Note: RNDIS, UVC and MSD   is known not to work... but that won't affect you - your E4 is still in default mode!

Offline realdoc

  • Contributor
  • Posts: 26
Re: Flir E4 Thermal imaging camera teardown
« Reply #5011 on: June 01, 2014, 10:08:53 am »
Please hit WIN+PAUSE under windows and navigate to device manager -> please post a screenshot showing all unknown devices listed there - my best guess would be you're missing the lower-level USB drivers or you have some strange security software running (upper or lower filters)

The only thing there is an Imaging Device with an exclamation mark called "FLIR Ex-Series". There is no Mass Storage Device, nor nothing else with exclamation marks.
 

Offline Taucher

  • Frequent Contributor
  • **
  • Posts: 456
  • Country: de
  • 1DsaYDGWXEYhEKL rfrbFyYsehaAtfBWawf
Re: Flir E4 Thermal imaging camera teardown
« Reply #5012 on: June 01, 2014, 10:33:16 am »
The only thing there is an Imaging Device with an exclamation mark called "FLIR Ex-Series". There is no Mass Storage Device, nor nothing else with exclamation marks.

Thats what I've expected - driver is not installed or not working.
Doubleclick that device and read/copy the explanation why it does not work (driver, not working properly etc)
-> maybe try install driver and if requested select the driver directory...

Offline realdoc

  • Contributor
  • Posts: 26
Re: Flir E4 Thermal imaging camera teardown
« Reply #5013 on: June 01, 2014, 11:03:43 am »
Thats what I've expected - driver is not installed or not working.
Doubleclick that device and read/copy the explanation why it does not work (driver, not working properly etc)
-> maybe try install driver and if requested select the driver directory...

Which driver are you using? I tried all of them in the Device Drivers folder, but they all result in a BSOD (blue screen of death).
 

Offline Taucher

  • Frequent Contributor
  • **
  • Posts: 456
  • Country: de
  • 1DsaYDGWXEYhEKL rfrbFyYsehaAtfBWawf
Re: Flir E4 Thermal imaging camera teardown
« Reply #5014 on: June 01, 2014, 11:11:04 am »
Which driver are you using? I tried all of them in the Device Drivers folder, but they all result in a BSOD (blue screen of death).
How about supplying some helpful data like BSOD message code (take it from syslog)...
« Last Edit: June 01, 2014, 11:18:34 am by Taucher »
 

Offline JFA

  • Regular Contributor
  • *
  • Posts: 53
  • Country: ca
Re: Flir E4 Thermal imaging camera teardown
« Reply #5015 on: June 01, 2014, 04:29:05 pm »
New problem on E4 1.1L  v1.22.0

The camera started to become erratic. I had a WinCE error (which I didn't note down).

Eventually, the up button would not work anymore.

I did a factory reset, cold boot, removed the improved menus, removed the res improve and I am now back to the stock E4.

The up-button on the paddle does not work. I cannot access emissivity controls anymore, unless I do a factory reset. Every time I go down into the config menu, I must do a factory reset to go to the top again.

I will try to return the unit, as it seems to be hardware-related.  Hopefully, I'll get a 1.22 back
Any comment?
« Last Edit: June 01, 2014, 04:37:06 pm by JFA »
 

Offline realdoc

  • Contributor
  • Posts: 26
Re: Flir E4 Thermal imaging camera teardown
« Reply #5016 on: June 01, 2014, 08:19:23 pm »
How about supplying some helpful data like BSOD message code (take it from syslog)...

I went through all the installed drivers for the video and they are all ment for a firewire thermalcam, so that might well be why they result in a BSOD. Unfortunately I have to leave home for work the upcoming week, so I cannot troubleshoot anything until next Friday. I let you guys know if I get any response from FLIR on my ticket tho :)

Thanks so far!!
 

Offline joe-c

  • Frequent Contributor
  • **
  • Posts: 350
  • Country: de
    • Joe-c.de
Re: Flir E4 Thermal imaging camera teardown
« Reply #5017 on: June 02, 2014, 11:57:16 am »
Whatever you want. Tomorrow. Send a PM with your E-Mail to me. You will get the file.
the best of all (1.19.8) could never been downloaded, right?
Freeware Thermal Analysis Software: ThermoVision_Joe-C
Some Thermal cameras: Kameras
 

Offline tom66

  • Super Contributor
  • ***
  • Posts: 6680
  • Country: gb
  • Electronics Hobbyist & FPGA/Embedded Systems EE
Re: Flir E4 Thermal imaging camera teardown
« Reply #5018 on: June 02, 2014, 10:05:52 pm »
Damn, I start work in July. I sure hope the Lepton E4 isn't out by then, because I'll finally be able to afford a proper E4 to upgrade. Otherwise FLIR will lose any prospect of money from me.

They should just make it so you can upgrade but it embeds a small watermark "Unauth. Upgrade" - that prevents professional users from using it (probably what they are most concerned about) - whilst allowing other non-pros to use it.
 

Offline realdoc

  • Contributor
  • Posts: 26
Re: Flir E4 Thermal imaging camera teardown
« Reply #5019 on: June 02, 2014, 11:13:37 pm »
They should just make it so you can upgrade but it embeds a small watermark "Unauth. Upgrade"
This is not a good idea.
It seems at the moment to be already too late, as currently the E4 is already delivered with the new FW 2.1.0. There is as yet no indication of a successful hack.
But on the bright side, there are also no signs of an unsuccesful hack. attempt The 2.1.0 sw and 1.2L hw are just very new and so far I seem to be the only one having them. Let's hope FLIR can fix the driver issues I experience, so I can hook my Ex up to FLIR Tools and see what happens :)  Just being able to transfer the pictures would be cool already haha.

Looking at the 2.1.0 firmware, it's still a WinCE environment with some magic, but the executables don't seem to be overly protected. The worst case would be that we would have to change our attack vector from the checksummed cfc file to the appcore.exe binary and dll, to change variables or prevent security checks from raising exceptions.
 

Offline Fraser

  • Super Contributor
  • ***
  • Posts: 13148
  • Country: gb
Re: Flir E4 Thermal imaging camera teardown
« Reply #5020 on: June 03, 2014, 08:35:41 am »
@realdoc.

I know it would not help this community but in your position I would be looking at returning your E4 for a refund as it is not fit for purpose due to the FLIR Tool connectivity issue. I would then put my efforts into finding an E4 with version 1.22 or earlier firmware. They are still available if you look around. There is the very real possibility that FLIR have done a decent job of locking down the platform this time. Nothing is unhackable if it has an I/O port BUT it may take a great deal of effort to succeed this time and such relies on 'others' having the time to assist. The fact that the E4 no longer communicates with its OEM software may even be an indicator of how locked down the new firmware is. As I have stated, an open I/O port is a vulnerability and FLIR know it. There are ways to ensure that a platform will only provide limited connectivity via its external ports and only to a specific application that is in itself locked down to prevent its easy use as an attack vector.

FLIR read this forum and will be learning from the conversations that occur here. If you wish to take the risk that they have missed an attack vector in their latest release then stick with it, but they have had plenty of time to perfect their defensive strategy and that new hardware revision makes me think they may have advanced to combined firmware and hardware lock downs. I may be totally wrong but while there are still older firmware cameras available, I would make life easier for myself and get one of those while you have the good treason to return your 2.1.0 camera.

Just my 5 Cents worth.
« Last Edit: June 03, 2014, 04:58:56 pm by Aurora »
If I have helped you please consider a donation : https://gofund.me/c86b0a2c
 

Offline pciebiera

  • Newbie
  • Posts: 4
  • Country: us
Re: Flir E4 Thermal imaging camera teardown
« Reply #5021 on: June 03, 2014, 03:59:56 pm »
FYI E4 ordered from Amazon US on May 30, 2014 arrived June 2, 2014 has firmware 1.22.
 

Offline oddy992

  • Contributor
  • Posts: 10
Re: Flir E4 Thermal imaging camera teardown
« Reply #5022 on: June 03, 2014, 04:16:52 pm »
Ok so I have been following progress on the hack for a while and took the plunge to find out I've got an e4 with the new firmware! :(

I'm having the same issue putting it into RNDIS mode, I can get to the menu and then select it but it never actually changes mode.

Oddly I'm not having driver issues as stated, I can view the camera video using Flir player.exe etc.

Any tricks I can try to get the camera to respond in RNDIS? Happy to provide any details necessary.
 

Offline ixfd64

  • Frequent Contributor
  • **
  • Posts: 345
  • Country: us
    • Facebook
Re: Flir E4 Thermal imaging camera teardown
« Reply #5023 on: June 03, 2014, 04:52:48 pm »
I wouldn't be surprised if FLIR deliberately disabled RNDIS mode to hamper the hack.

Offline Fraser

  • Super Contributor
  • ***
  • Posts: 13148
  • Country: gb
Re: Flir E4 Thermal imaging camera teardown
« Reply #5024 on: June 03, 2014, 05:10:51 pm »
The camera will likely still have an I/O port that is open for calibration tasks so it is unlikely to be totally locked down but activation may require either a 'secret' key sequence or the correct 'Open Sesame' command from a host computer. There are so many ways to slam the door shut on users by denying them the attack vectors that are needed to 'probe' the OS and firmware. Sadly when a manufacturer goes for a nice tight lock-down, you often have to move from a close case, to open case hack involving direct access to key chips in the system. There is the RS232 port on the motherboard but FLIR know that this was discovered and exploited by Mike. It may end up with someone having to open their new E4 to see what, if anything, has changed since HW 1.0 and 1.1L. It would be a real shocker to see a LEPTON core sat where once a 320x240 microbolometer had resided ! Panic not, it's unlikely that this has been done. The FPGA config files are what would worry me. As others have stated, reverse engineering an FPGA is not a real option and so any countermeasure that involved the FPGA could be very effective.
If I have helped you please consider a donation : https://gofund.me/c86b0a2c
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf