Author Topic: Flir E4 Thermal imaging camera teardown (Read 3790806 times)

mikeselectricstuff · « **Reply #5225 on:** July 07, 2014, 10:13:29 pm »

Quote from: Taucher on July 07, 2014, 06:38:01 pm

Whoever decides to delete the own posts - I think that's their right (but an useless action anyway).

But it would be polite to post an explanation.

jjmmss00 · « **Reply #5226 on:** July 08, 2014, 11:49:42 am »

Quote from: tomas123 on July 07, 2014, 10:11:34 pm

Code: [Select]
$ convert -define png:swap-bytes t1.png t2.png $ convert t2.png -auto-level t3.png

This works great. I have been moving on to try and get PHP functioning. Will this change affect the flir.php script? Thanks for your support.

Fraser · « **Reply #5227 on:** July 08, 2014, 11:50:42 am »

After I deleted some messages, many moons ago, I realised that I could have deleted just the text content, but that was a lesson learnt. Some people may be deleting their whole posts and even their eevblog account for reasons best known to themselves. Hopefully not as a result of pressure from any party.

Aurora

tomas123 · « **Reply #5228 on:** July 08, 2014, 01:13:10 pm »

Quote from: jjmmss00 on July 08, 2014, 11:49:42 am

This works great. I have been moving on to try and get PHP functioning. Will this change affect the flir.php script? Thanks for your support.

please edit the corresponding lines in the php code

I wrote a support request for your problem in the IM forum

http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=25875

frischky · « **Reply #5229 on:** July 08, 2014, 06:18:26 pm »

Long time viewer of EEV on YT, but just came across this thread while Googling the E4.

Is there still many "upgradable" E4's left in the supply chain or is the newer hardware/firmware very prevalent?

I have no professional need for a TIC, but ever since a kid when I saw these at the Science Centre (were cooled by liquid nitro I think at the time) TICs always intrigued me. So if there is still plenty of old stock, I am thinking of picking one up.

Fraser · « **Reply #5230 on:** July 08, 2014, 07:04:50 pm »

Much depends on which country you are in and the stock holding of retailers.

You could take a look on ebay as there are plenty for sale at RRP on there and they often state the firmware version.

frischky · « **Reply #5231 on:** July 08, 2014, 09:13:47 pm »

Thanks for the info. Will have to roll the dice and hope for the best.

micio · « **Reply #5232 on:** July 09, 2014, 01:36:31 pm »

Hi guys, I've been following this thread since day one and I have an E4, I was wondering if there was an easy step to remove the temperature scale and other elements over the picture so that it's just a thermal image. (i was only able to remove the logo)

Thanks!

KyleK29 · « **Reply #5233 on:** July 10, 2014, 12:29:36 am »

Might be well known, but my E4 with 2.3.0 ended up soft-bricked (or appeared so).

It would turn on and just have a black screen, I was able to revive it using the firmware pack at the FLIR site. Open FLIR Tools, hold SHIFT+CTRL+ALT and click the box under "Check for updates". This will force an update. Selected the .FIF and then the eFlirInstall.exe. It copied and hung. I then disconnected and replugged it in, redid that procedure and it copied the entire package. Rebooted camera when prompted and the package installed - failed and said "update failed, please reboot and try again". Did so and it successfully took it. Works like new again.

Posted here just encase anyone messes up their 2.3 based camera by FTPing into it.

Does anyone have a mirror of the 1.22 firmware? I want to check something.

ixfd64 · « **Reply #5234 on:** July 10, 2014, 05:03:47 am »

Be careful about downgrading your camera. There are reports that doing so bricks the device.

Taucher · « **Reply #5235 on:** July 10, 2014, 05:38:29 am »

Yes, most likely the bootloader is different (the chipset supports encryption and signing from bootblock level up) - I didn't check myself, but the bin/NK disassembly instructions are still around (they are pretty generic). Worst case would require the memory to be re-written externally (by programmer) as the built-in-flasher could fail to update/change certain flash-areas.

Please note that I'm NOT an expert in firmware bootloading etc. but more a systems generalist.
The described method with "force update" above could really be the key to un-bricking the camera.

Basically any step involved in bootup has to work - otherwise the camera will seem bricked:
- bootloader
- read & parse configuration data
- boot applications

For example: if one changes the bootloader and the binaries, then one also has to change the config files as the old software won't be able to expect - or parse new checksums or obfuscation layers introduced in later versions.

A complete copy of firmware AND configuration could be a method of downgrade - assuming one does not forget the serial number inside I²C.
Another approach would be to patch the code that reads the serial from I²C to return something pre-defined...

Just an idea for anybody who wants to try

GTPprix · « **Reply #5236 on:** July 10, 2014, 04:34:12 pm »

Long time lurker, first time poster. First off just wanted to thank everyone thats contributed to this quite frankly amazing thread. I have been thinking about buying one of these for ages but with the advent of the new firmware decided to move on it and I should have it tomorrow.

Hoping that I get 1.22 but I guess we'll see

bookaboo · « **Reply #5237 on:** July 11, 2014, 07:12:34 am »

Quote from: Taucher on July 10, 2014, 05:38:29 am

Yes, most likely the bootloader is different (the chipset supports encryption and signing from bootblock level up) - I didn't check myself, but the bin/NK disassembly instructions are still around (they are pretty generic). Worst case would require the memory to be re-written externally (by programmer) as the built-in-flasher could fail to update/change certain flash-areas.

Please note that I'm NOT an expert in firmware bootloading etc. but more a systems generalist.
The described method with "force update" above could really be the key to un-bricking the camera.

Basically any step involved in bootup has to work - otherwise the camera will seem bricked:
- bootloader
- read & parse configuration data
- boot applications

For example: if one changes the bootloader and the binaries, then one also has to change the config files as the old software won't be able to expect - or parse new checksums or obfuscation layers introduced in later versions.

A complete copy of firmware AND configuration could be a method of downgrade - assuming one does not forget the serial number inside I²C.
Another approach would be to patch the code that reads the serial from I²C to return something pre-defined...

Just an idea for anybody who wants to try

This could be a problem as you can't just use a conf file from another camera, if you do the camera will work and the image is 320x240... but it looks grainy and not unlike a 80x60 image. My guess is that each bolometer has a slightly different output (more than just dead pixels) and this is calibrated and mapped in the factory.

Taucher · « **Reply #5238 on:** July 11, 2014, 07:27:26 am »

Quote from: bookaboo on July 11, 2014, 07:12:34 am

Quote from: Taucher on July 10, 2014, 05:38:29 am
...A complete copy of firmware AND configuration could be a method of downgrade - assuming one does not forget the serial number inside I²C.
Another approach would be to patch the code that reads the serial from I²C to return something pre-defined...
This could be a problem as you can't just use a conf file from another camera, if you do the camera will work and the image is 320x240... but it looks grainy and not unlike a 80x60 image. My guess is that each bolometer has a slightly different output (more than just dead pixels) and this is calibrated and mapped in the factory.

Well, that could be fixed by re-calibrating - the "good old" 17/18 firmware did come with the built-in webserver incl. re-cal.
Also we have had a few forum members who played with the cal-data, pixel masks etc... that stuff is little of a problem - but you're right - the "repace anything" solution would require a re-cal...
or one has to down-convert the config files in order to get perfect results.

Oh... and BTW - another idea: take an E8 - copy contents and I2C ...

Edit: Post #5252

GTPprix · « **Reply #5239 on:** July 11, 2014, 06:37:31 pm »

Got my E4 today from Amazon with 1.22 on it (what a relief!) Had it modded within ten minutes of getting it; freakin amazing

vmp · « **Reply #5240 on:** July 13, 2014, 06:33:24 pm »

My FLIR E4 was repaired. The firmware was changed to 2.3. Is there any way to downgrade. Where can I download old firmware to flir e4. Maybe someone earlier downloaded firmware from flir.com and can share.

Fraser · « **Reply #5241 on:** July 13, 2014, 08:07:21 pm »

There is no known way back from Firmware 2.3.

You may not even have the same main board in your repaired camera. Sadly you are locked into standard E4 specification.

Aurora

vmp · « **Reply #5242 on:** July 13, 2014, 08:16:52 pm »

Not much time was needed to improve the resolution. I changed the original configuration file manually. Fixed checksum using old tools. I switched the original file. After the restart I gained full native resolution.

miguelvp · « **Reply #5243 on:** July 13, 2014, 08:57:52 pm »

That's an interesting turn of events

Care to elaborate what tool you used and some details on what you did?

mikeselectricstuff · « **Reply #5244 on:** July 13, 2014, 09:21:27 pm »

Has anyone here actually seen a production 2.3 unit & had a serious play?
I don't recall seeing anyone posting about it, just a few comments from people who've looked at the downloaded update files.

It may be that there are differences between units that are manufactured (and calibrated) with newer FW vs. those that have been subsequently updated.
These differences could provide some useful clues. I'd have though the bootloader would be an obvious place for them to have added something, but from what vmp says, he has 2.3 running an old config file, not downgraded the FW to an earlier version.

BTW I bookmarked several ebay auctions for upgraded units over a week ago & no sign of any being taken down.

vmp · « **Reply #5245 on:** July 13, 2014, 09:39:58 pm »

I connected the camera as RNDIS using flirs tool FLIRInstallNet and Set_RNDIS_temporary.fif from this forum.
I downloaded the file conf.cfg from my flir e4 using FileZilla. (ip: 192.168.0.2 user: flir pass: 3vlig )
In Notepad I've changed:
". caps.config.image.settings.IRwidth int32 80
. caps.config.image.settings.IRheight int32 60 "
to
". caps.config.image.settings.IRwidth int32 320
. caps.config.image.settings.IRheight int32 240"
I've Fixed checksum using crc01.exe ( tool from this forum).

I switched the original file. After the restart i have 320x240 resolution in thermovision.

My conf.cfg was not encrypted.
My camera info:
Model: E4 1.1
serial: 639xxxxx
part number: 63901-0101
software 2.3.0

mikeselectricstuff · « **Reply #5246 on:** July 13, 2014, 10:03:07 pm »

Seems reasonable that when upgrading FW it would keep the old config file, at least for an end-user upgrade, but looks like they did change it to a standard one with 80x60, but left it in the old format.
So the question is, how might you make a production 2.3 unit think it's an old but upgraded unit (assuming production 2.3 is the same as "upgrade" 2.3)?
Bootloader version/functionality? EEPROM? Hardware differences ? Serial number?
It shouldn't be too hard to find where it's checking for this.

Here we go again...

Fraser · « **Reply #5247 on:** July 13, 2014, 10:12:47 pm »

Excellent work VMP

You have just given hope to those who have had to return their cameras to FLIR.

As Mike states, the production FW2.3 cameras may be a more challenging platform but at least your 'upgraded' unit was capable of being returned to its former self

What was wrong with your camera that required it to be returned ? If they had fitted a new main board I would have expected it to be a production FW2.3 version spare part.

Aurora

mikeselectricstuff · « **Reply #5248 on:** July 13, 2014, 10:17:19 pm »

Quote from: Aurora on July 13, 2014, 10:12:47 pm

Excellent work VMP

You have just given hope to those who have had to return their cameras to FLIR.

As Mike states, the production FW2.3 cameras may be a more challenging platform but at least your 'upgraded' unit was capable of being returned to its former self

What was wrong with your camera that required it to be returned ? If they had fitted a new main board I would have expected it to be a production FW2.3 version spare part.

Aurora

Or it could be that their spares stock is still older boards - these would probably move rather more slowly than production units so could hang around rather longer.
Interestingly vmp's hardware version was not showing the mysterious "L".

vmp · « **Reply #5249 on:** July 13, 2014, 10:24:01 pm »

Quote from: Aurora on July 13, 2014, 10:12:47 pm

What was wrong with your camera that required it to be returned ?

My camera had a hot spot in every picture. The motherboard was good, after repairing the serial number is the same.


EEVblog Main Site	EEVblog on Youtube	EEVblog on Twitter	EEVblog on Facebook	EEVblog on Odysee

Poll

Has the hackabiliy of the E4 made you buy one :

Author Topic: Flir E4 Thermal imaging camera teardown (Read 3790806 times)

Share me