Flir E4 Thermal imaging camera teardown

[Fraser]

There is no need to apologise on this forum....we are all friends in a discussion....you just voiced what many were likely thinking. Take a look in my past posts and you will se that I had concerns that FLIR MIGHT fit a LEPTON to slam the door shut on the whole E4 upgrade situation.

I am a pessimist by nature so look for the worst case scenario..... I would still be of a mind to return any FW2.1.0 camera if there was an option to obtain a 1.22 or earlier version  Once all 2.1.0 cameras have been sold users will have no choice but to risk a 2.1.0 unit.....that situation has not been reached yet.

Life is too short already....don't waste your life solving a problem that may be circumvented....unless of course you enjoy doing so 

[oddy992]

Thanks Aurora,

For me its a challenge and I'd rather help with a new hack than take the easy route.

Do you know who wrote Ftool.exe? Seems like it needs modification to understand / decrypt the new cfc.

[mikeselectricstuff]

Thanks Mike, it did sound an extreme countermeasure but in the car industry anti tamper seems to be a more common element of designs these days. Have you had any time to look at the Autoliv camera recently ? I was offered one at a decent price but chickened out as I do not have the required skillset to hack it....I bought a FLIR SC3000 cooled camera instead 

Not yet - still in the big pile of stuff to be played with.

[ixfd64]

Do you know who wrote Ftool.exe? Seems like it needs modification to understand / decrypt the new cfc.

I think forum member "ds" made it.

[Iphone_hack]

Grateful for your units calibration date and the hardware build (detailed in camera details page)

Model: E4 1.2L
S/N: 639285XX
Part Number: 63901-0101
Date: 23 May 2014

Hi
Could you tell us when did you order and what country?
I am in canada
I ordered my second E4 on May 15
Now I am really worry
Still haven't got it from my local supplier, which says coming from the East coast of canada

Hi guys
I finally received my 2nd E4 today that I ordered on May 15
So nerviours when checking the version
I am so freaking happy
Here is info that you can add

Ordered on May 15th received on June 4th
Canada location
E4 1.1L
Serial 63926xxx
1.22.0
Calibration date may 6th 2014 Estonia

I am so glad
I will be hacking the resolution tonight!

[Iphone_hack]

Perhaps the solution is as simple as picking up an E5. That one can't use a Lepton.

Good ideas but mostlikely have new firmware upgrade too

Upgraded the resolution of my second unit without problem
 

[oddy992]

so playing with rcd & rls commands on the device last night I managed to get a listing on the detector and it stated 320*240 so that pretty much rules out a Lepton detector. Can't remember the r'path but it definitely had those values. Also while poking around I found a frequency setting at 9.0009123 (or something like that).

Stupid question: In the PDF for the commands that the FLIR supports it states that this can be written ... Can't a temporary set command be used to adjust the frequency until the next reboot?

And if so, what would that command look like? (I hate interpreting those command manuals, I got where I got to last night by a bit of reading and more trial and error).

[joe-c]

Can't remember the r'path but it definitely had those values.

I searched in the full tree and found many places for a resolution setting... some of them could only be read.
I think the most interesting Info is the Detector type string:
.image.flow.detector.type             "SB320 ISC0901"
The other paths was in attachment.

Stupid question: In the PDF for the commands that the FLIR supports it states that this can be written ... Can't a temporary set command be used to adjust the frequency until the next reboot?

I don't remember the command, but I only could set the frequency somewhere. I used the Value 25 and get from the Value "real frequency" or something else only 7-10.4
But maybe it was only the measurement frequency. It's too long in the past...

[Taucher]

Regarding frequency please be pointed to the discussions that we had about ITAR and such issues causing a _REAL_ issue for Flir - that frequency thing would probably force big changes.

As much as I understand is that the sampling is already happening at 30Hz but is beeing resampled down by the FPGA so the output at the display is just 9Hz.

[mikeselectricstuff]

As much as I understand is that the sampling is already happening at 30Hz but is beeing resampled down by the FPGA so the output at the display is just 9Hz.

And that resampling is probably what allows them to use such a small lens - I suspect a 60fps image would be very noisy.

[wolflsi]

Hello, I am a new FLIR E4 user in Taiwan,I bought FLIR E4 two days before(6/4), Camera information shows model E4 1.1L,software version 1.22 S/N is 63926142 P/N is 6301-0101,so it means not every new FLIR E4 is with hardware 1.2L and software 2.XX ?

[FireBird]

It depends on how large your dealer's stock of 1.22 E4s is.

[mamalala]

As much as I understand is that the sampling is already happening at 30Hz but is beeing resampled down by the FPGA so the output at the display is just 9Hz.

And that resampling is probably what allows them to use such a small lens - I suspect a 60fps image would be very noisy.

Are there any 30/60 fps Ex cameras? From what i understand, ITAR is mostly about export restrictions, right? If so, could there be higher framerate Ex cams on the US market? Or are they all 9 fps cams?

Greetings,

Chris

[OrBy]

As much as I understand is that the sampling is already happening at 30Hz but is beeing resampled down by the FPGA so the output at the display is just 9Hz.

And that resampling is probably what allows them to use such a small lens - I suspect a 60fps image would be very noisy.

Are there any 30/60 fps Ex cameras? From what i understand, ITAR is mostly about export restrictions, right? If so, could there be higher framerate Ex cams on the US market? Or are they all 9 fps cams?

Greetings,

Chris

All public eX series are 9hz. (there was talk of a FLIR demo unit that ran at a higher rate that was seen at a trade show) To get higher you need to move to the eXX series tier. They have different hardware and larger lenses. Due to the small lens on the eX's, a 15Hz/30Hz frame rate would likely be the max it could support before looking like psychedelic poo.

[mamalala]

All public eX series are 9hz. (there was talk of a FLIR demo unit that ran at a higher rate that was seen at a trade show) To get higher you need to move to the eXX series tier. They have different hardware and larger lenses. Due to the small lens on the eX's, a 15Hz/30Hz frame rate would likely be the max it could support before looking like psychedelic poo.

Ah, thanks! Wasn't aware of that, i was thinking that it maybe only for the exported cams.

Greetings,

Chris

[Iphone_hack]

Hello, I am a new FLIR E4 user in Taiwan,I bought FLIR E4 two days before(6/4), Camera information shows model E4 1.1L,software version 1.22 S/N is 63926142 P/N is 6301-0101,so it means not every new FLIR E4 is with hardware 1.2L and software 2.XX ?

Even you bought it on June 4th
You have to see your calibration date
That is the date mostlikely came out of factory
My second unit was luckily May 6th and it was still 1.1L and 1.22.0

Another member had calibration date may 23rd
It was 1.2L and 2.1.0

So between May 6 to May 23 flir upgraded the firmware

[OrBy]

All public eX series are 9hz. (there was talk of a FLIR demo unit that ran at a higher rate that was seen at a trade show) To get higher you need to move to the eXX series tier. They have different hardware and larger lenses. Due to the small lens on the eX's, a 15Hz/30Hz frame rate would likely be the max it could support before looking like psychedelic poo.

Ah, thanks! Wasn't aware of that, i was thinking that it maybe only for the exported cams.

Greetings,

Chris

That would likely lead to quite a few headaches for everyone involved if they had a exportable and non-exportable versions of the same cam. The Ex's are the cheapies to get people hooked. They want to sell them everywhere to everyone and simple is the key to doing that. Then when you want good images and features you get to pay $$$ as long as your not in a ITAR restricted country .

LCDC.DLL "C.a.m.e.r.a. .F.P.S.:"

[mikeselectricstuff]

As much as I understand is that the sampling is already happening at 30Hz but is beeing resampled down by the FPGA so the output at the display is just 9Hz.

And that resampling is probably what allows them to use such a small lens - I suspect a 60fps image would be very noisy.

Are there any 30/60 fps Ex cameras? From what i understand, ITAR is mostly about export restrictions, right? If so, could there be higher framerate Ex cams on the US market? Or are they all 9 fps cams?

Greetings,

Chris

The Ex0 series are 60fps. There is some confusion as Flir used to refer to the Ex0 as E series before the Ex came out - they should have used a different letter.
You can buy the Ex0 in most countries but need an export license to ship between countries. I think there may also be some end-user ID check when buying from a dealer in your country, though there seem to be plenty of >9fps TICs at general distributors Like RS and farnell   

[mamalala]

The Ex0 series are 60fps. There is some confusion as Flir used to refer to the Ex0 as E series before the Ex came out - they should have used a different letter.
You can buy the Ex0 in most countries but need an export license to ship between countries. I think there may also be some end-user ID check when buying from a dealer in your country, though there seem to be plenty of >9fps TICs at general distributors Like RS and farnell   

Yeah, the whole ITAR thing sound pretty silly to me anyways. I mean, really, why re-use a cam, that is meant for a completely different application like the Ex or Ex0, in some kind of hacked up weapon. Especially if you can get higher fps cams anyways. And then, someone who really wants that stuff to do harm has no problems getting used mil stuff anyways... Guess the pencil pushers just need some justification for their job...

Greetings,

Chris

[Iphone_hack]

FW version 1.22.0 is now once again the latest version.
FlirTools don't want to update to 2.1.0! 

You mean if any new cameras shipped out with 2.1.0 can downgrade?
 

[AintBigAintClever]

The Ex0 series are 60fps. There is some confusion as Flir used to refer to the Ex0 as E series before the Ex came out - they should have used a different letter.
You can buy the Ex0 in most countries but need an export license to ship between countries. I think there may also be some end-user ID check when buying from a dealer in your country, though there seem to be plenty of >9fps TICs at general distributors Like RS and farnell   

I've just picked up an old FLIR ThermaCAM E25 (made in 2004), that's 50/60fps with video output (and tripod mount), but 160x120 resolution. Results from one of the Telnet commands indicates that it's got a SIM300 FPA (presumably the 160x120 SIM300L and not the 320x240 SIM300H - specs sourced from http://www.dtic.mil/dtic/tr/fulltext/u2/a424873.pdf page 18).

For those interested, here's the E25's file structure visible through FTP:-

BITMAP.SYS
FLIST.SYS
system\bw.pal
system\bwr.pal
system\calib.reg
system\default.reg
system\fesi.bin
system\filekit.rev
system\fpga.bin
system\French.FLF
system\German.FLF
system\indi.bin
system\iron.pal
system\Italian.FLF
system\logo.bmp
system\matrix.elf
system\rainbow.pal
system\Spanish.FLF
system\calib\org\Caldata.htm
system\calib\org\Calprotocol.htm
system\calib\org\Caltuning.htm
system\calib\org\Camera.htm
system\calib\org\Checklist.htm
system\calib\org\DefBBTemps.htm
system\calib\org\Detector.htm
system\calib\org\OPspec.htm
system\calib\org\TCPBlockdata.htm
system\factory.d\local.reg
system\factory.d\model.reg
system\factory.d\poff.reg
system\factory.d\silentstart.reg
system\factory.d\trig.reg
system\maps\ds120C_fi_leFOV25_vi_ro.gan
system\maps\ds250C_fi_leFOV25_vi_ro.gan
system\maps\ds900C_fi_leFOV25_vi_ro.gan
system\web\back.jpg
system\web\camera.gif
system\web\flirtrans.gif
system\web\goahead.gif
system\web\index.asp
system\web\login.asp
system\web\user\todo.asp

Digging into the matrix.elf header indicates that it's 32-bit Big-Endian PowerPC code.

Web browsing to the camera gives access to a service web page login, but logging in (3vlig) gives a Page Not Found error as the service pages aren't in the camera.
Blanking logo.bmp (I used HxD as Paint messed it up) will remove the bootup and on-screen logo.

Hexediting the matrix.elf file uncovers a pair of hidden telnet commands:-
rlock: Lock resource commands
runlock: Unlock resource commands: runlock <code>
runlock 3vlig results in runlock: changed uid to root which unlocks some of the commands. videotest on/off for example only works as root.
The id command shows who you're logged in as. If you've runlocked to root, the runlock status survives a power-cycle (you don't revert to the shell/user UID).

Adding the palette files from addmenu beta 3 works. No need to edit any menus, just FTP them across. 

By the way Mike, congratulations and thanks for completely upturning the TIC market, both new and second-hand. FLIR expected to do it with Lepton, you beat them to it with their own Ex range

To paraphrase The Mary Whitehouse Experience:-
"You see that blip in TIC sales and drop in price?"
"I am aware of it's presence."
"That's you, that is."

[IrishRocker]

Hi all,

I need help, I want to attempt hacking a FLIR E8.....to E4 specs?
 

Just kidding! Don't actually own FLIR...yet! been watching EEVBlog on youtube for years now, ever since that pickit 3 review! but have only now joined the forum!

[realdoc]

So far, FLIR did not answer my support ticket about my broken camera in detail yet. The status of my ticket and update date does change a lot, so I think they are very busy working on it internally.

I'm really looking forward to their final answer. As of now, I still think they broke something bad in an attempt to fix something else

[bookaboo]

Just skimming through the last posts, are you guys with v2.1 having trouble connecting to Flir Tools? I have a colleague who has just contacted me to day he bought an E4 and it's come with v2.1, he is able to connect to Flir Tools and transfer images.

He will probably bring the camera to me tomorrow or Monday so I can have a look, feel free to suggest things that can be checked, I will see if we can be of any help.

[AintBigAintClever]

I've found another three .pal files for the cameras. These were lurking in the Mac version of FLIR Tools. Tested and working on a ThermaCAM E25 (so I've now got 11 palette options including the "Heat Detect" one), the colours are:-

Blue-Red Blended (like a subset of Rainbow but without the black bottom and white top)
Saturation (grey scale but with a blue bottom edge and red top edge)
Yellow (green black at the bottom through to yellow at the top)

UPDATE
I've managed to convert the RGB palettes in some of the other files (glowbow, medical and grayred) to the YCrCb format used by the cameras. I've also corrected yellow.pal which had RGB palette info instead of YCrCb. The original palettes had 120 colours (10 in the case of medical), these have been expanded to 224 with interpolated colours filling in the gaps instead of just doubling them up (medical being the exception once again). 14 palettes now working happily on my E25, menu selectable. 

The attached zip file has been updated to include the additional & corrected palettes. Anybody got any other palettes I can have a pop at?