Flir E4 Thermal imaging camera teardown

[wer4]

My E4 1.22 got stolen
Just bought a new one but came with the 1.23..
I read there is not hack yet, do you guys think that there will be one soon?

Thanks for the incredible job you have done.. i really enjoyed my old E4 upgraded to E8, now is very hard to go back.

1.23??? Are you sure you did not get 2.3?

[aarnulfo]

My E4 1.22 got stolen
Just bought a new one but came with the 1.23..
I read there is not hack yet, do you guys think that there will be one soon?

Thanks for the incredible job you have done.. i really enjoyed my old E4 upgraded to E8, now is very hard to go back.

1.23??? Are you sure you did not get 2.3?

My mistake.. it is a 2.3

[cdmanii]

thank you very much~

but i can not find E60 conf.cfg and ui.cfg

Do you have FLIR E60 Origin conf.cfg and ui.cfg file ?

[chriseparent]

O0 O0 O0 O0 O0 O0

has anyone located a source for 3d printed TELEPHOTO lens for the E4?
(US supplier or will ship to the US)

 

Do you have the file?  I could look at it and maybe print it.

I will see if it exists
Thank you

[mucek]

Do you have FLIR E60 Origin conf.cfg and ui.cfg file ?

Here's all you need in specific folders. Do mind, that you have to change SNs and calculate and write CRC01.

Regards,
Gregor

[cdmanii]

thank you very much !~

[Tom9999]

   Hi guys, I just got my ordered from amazon.ca few minutes and my FW is 2.1.0 + E4 1.2L.  I got lucky on old batch and amazon.ca still got 6 let when I was ordering at 10 let.

ps: what is easy way to to hack it or I will try to read more before do anything.

Thank all

[Fraser]

FW 2.1 and 2.3 have the same anti hacking protection. You needed FW 1.22 or earlier.

There is no hack for 2.x firmware in circulation at this time and I don't expect one any time soon.

[Tom9999]

  I was thinking FW 2.1.0 with old board 1.2L that hackable but I am now confused.

[Fraser]

No firmware after 1.22 is hackable at this time. FW2.1and 2.3 with Hardware 1.2L are the protected releases that use encryption to prevent the hack.

Sorry it isn't better news for you.

[Tom9999]

  I am understanding now and thank you.

[ixfd64]

Even signed firmware can theoretically be hacked:

Just a short comment regarding hacking a public/private crypto system:

-> find public key stored in device
-> replace public key with own one
-> re-sign all signed stuff
-> have fun

In case the key is hardwired somewhere, then just patch the comparison routine(s).
-> In short: Flir is just setting up a challenge instead of ensuring that their customers get maximum satisfaction.

It's just that nobody has implemented the method yet.

[Tom9999]

  I think one can hacked but posting it that other problem and someone dont want to deal with Flir.

[Echo88]

Im thinking about removing the display from my E4 (wanna use it just as a small thermocam for my pc, so no need for the bulky display). Can the removement of the display be problematic on the electronic side? As is it just a data-bus to the display im assuming it should be no problem, as long as the bootloader doesnt care if the display isnt there.

[Pinkus]

Hey guys,
I need some help: I did hack the E4 with Tauchers beta 2 and it was working fine, I then installed the beta 3 including zoom and including the files  MP4.dll und Mediaserver.exe. It looked good after a first glance and thus I disabled RNDIS and set it back to normal USB mode.

But now, the camera is crashing every time on restart. Because of this I do not have any access to the USB menu (to set it back to RNDIS) anymore as it is crashing before I can go there (Appcore.exe).
What can I do? There might be something buried in this thread, but you know how exhausting 365 pages can be.
Thanks!!

-Edit: complete backups of original and of the working hack (Tauchers beta 2) are available of course.

[mikeselectricstuff]

Im thinking about removing the display from my E4 (wanna use it just as a small thermocam for my pc, so no need for the bulky display). Can the removement of the display be problematic on the electronic side? As is it just a data-bus to the display im assuming it should be no problem, as long as the bootloader doesnt care if the display isnt there.

Shouldn't be a problem - it's a controllerless type so the main board likely won't notice. Without the display it would probably be possible to power it from USB but you may need some fiddling to avoid confusing the power management /charging system.
One problem is that you still need the frame to hold everything together, though if this is a permanent mod you could cut it down or make a substitute.
If you were doing this from scratch, the therm-app might be a better option , though at the moment it only supports Android.

One thing you may want to check though is the backlight supply- I'm assuming it's a step-up, and though these typically have protection against  the overvoltage that would otherwise occur if the load is disconnected, it may not be a good idea to run it continuously like this. Shouldn't be hard to find the backlight supply & disable it, e.g. by removing /disconnecting the inductor

[Taucher]

Hey guys,
I need some help: I did hack the E4 with Tauchers beta 2 and it was working fine, I then installed the beta 3 including zoom and including the files  MP4.dll und Mediaserver.exe. It looked good after a first glance and thus I disabled RNDIS and set it back to normal USB mode.

But now, the camera is crashing every time on restart. Because of this I do not have any access to the USB menu (to set it back to RNDIS) anymore as it is crashing before I can go there (Appcore.exe).
What can I do? There might be something buried in this thread, but you know how exhausting 365 pages can be.
Thanks!!

-Edit: complete backups of original and of the working hack (Tauchers beta 2) are available of course.

#1 Rule: Check free space on the device
#2 Remove Battery and insert it right back - try booting then.

If nothing goes, try re-flashing with old/original firmware - it might need some tweaking of the update-commands
then repeat the mods - the DLL and mediaserver.exe are just for reverse-engineering guys and were an attempt to get video functionality (which clearly exists at some point).

[Pinkus]

Thanks taucher,
I am now about creating a new FIF file where I am deleting the files I added since the last backup and replacing all changed files with the files from the latest (working) update. I am crossing my fingers.
I will report back if everthing works out.

[Echo88]

Thanks for the answer Mike! It was planned from the start to hack the E4 for the resolution/palettes and then cut it down to fit on my stereo-camera. At the time of the purchase i didnt knew about ThermApp, but it costs 1k and also has only the E4-resolution and is no UVC-device like the FLIR, so the FLIR is still more suitable for me.
As you mentioned i want to use only USB to power the FLIR, so i taught about the following:

FLIR is connected to USB, also a separate DCDC-converter (5V to 5V, isolated) gets the 5V from the USB, behind the converter is a standard voltage regulator (LM317T for example) including the backcurrent-protection-diode, which sets the converter/regulator-output-voltage to the maximum battery voltage. This voltage is fed into the battery-port to simulate a charged battery.   
Any thoughts about that?

As you said im gonna need to disable the backlight-stepup-converter. Also i want to use the commando-UART on the pcb to command the FLIR over RS232-TTL (i assume TTL), instead over Telnet. Do you have a drawing/plan where those UART-pins are on the pcb?

[mikeselectricstuff]

Thanks for the answer Mike! It was planned from the start to hack the E4 for the resolution/palettes and then cut it down to fit on my stereo-camera. At the time of the purchase i didnt knew about ThermApp, but it costs 1k and also has only the E4-resolution and is no UVC-device like the FLIR, so the FLIR is still more suitable for me.
As you mentioned i want to use only USB to power the FLIR, so i taught about the following:

FLIR is connected to USB, also a separate DCDC-converter (5V to 5V, isolated) gets the 5V from the USB, behind the converter is a standard voltage regulator (LM317T for example) including the backcurrent-protection-diode, which sets the converter/regulator-output-voltage to the maximum battery voltage. This voltage is fed into the battery-port to simulate a charged battery.   
Any thoughts about that?

As you said im gonna need to disable the backlight-stepup-converter. Also i want to use the commando-UART on the pcb to command the FLIR over RS232-TTL (i assume TTL), instead over Telnet. Do you have a drawing/plan where those UART-pins are on the pcb?

UART id on the FFC connector - pinouts here
https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg316424/#msg316424

A 317 regulator may not do the job as it won't be expecting voltage back into it. Maybe if you set the voltage at 4.2-4.3 to simulate a fully charged battery so it never tries charging. Suggest you take a look at the datasheet of the battery manager to see how to go.
Somethting that would be worth a try is to see if it will run from USB power with the battery dicsonected.
one issue you may have is that it needs the power button closing to start - not sure if you can wire this permanently closed without side-effects.
Fortunately the on/off switch contact is on the FFC cable along with the Uart - I suspect they also use this during test.
There is also a power pin on the FFC, so it may be possible to supply power (4.2, maybe even 5V - maybe use 5Vusb via a 1N4001 to drop voltage a bit. ) to this - again this may be for powering it during test/cal.

[Megla]

I have been wondering if it is possible to change the lense on the flir e4 cammera for na narower field of view (im using it for airsoft games and i need range )
i was looking the lenses for therm app 19mm it should be for a longer ir range ?
and if any1 has tryed something simmilar ?

[mikeselectricstuff]

I have been wondering if it is possible to change the lense on the flir e4 cammera for na narower field of view (im using it for airsoft games and i need range )
i was looking the lenses for therm app 19mm it should be for a longer ir range ?
and if any1 has tryed something simmilar ?

The problem is the mount is rather constrained in terms of space, so choice of lens is limited.
For a narrower FOV you may need a larger lens to get sufficient signal. 

[Megla]

Thank you for the reply !

I am aware that i need a bigger lense for a narower field of wiew therefore i have been looking at these lenses
http://therm-app.com/product/6-8mm-lens/
this one 6.8mm looks simmilar as in a e4 device and has a simmilar field of view
http://therm-app.com/product/19mm-lens/
and this one has a bit bigger lense and a narower field of view (actualy the housing of a lense is similar but the outer lense seems to be bigger) i am only worried about the threads since on the first look they do not seem to be the same size and theese lenses are made for therm app thermal device and i havent seen the thread specs anywhere (they appear to be bigger) :/ i am hoping on implementing something simmilar in to an e4 device without significant housing modifications


this is my video of a test at 150m of a mansize target... if he would be in the woods i would not be able to pick him up and the airsoft gun ranges are at 130m (heavly modified)

plus i havent found anny germanium based lenses yet to be a drop in for e4 there are for ex0 series....

oh and i appolagise for my bad eanglish

[mikeselectricstuff]

Thank you for the reply !

I am aware that i need a bigger lense for a narower field of wiew therefore i have been looking at these lenses
http://therm-app.com/product/6-8mm-lens/
this one 6.8mm looks simmilar as in a e4 device and has a simmilar field of view
http://therm-app.com/product/19mm-lens/
and this one has a bit bigger lense and a narower field of view (actualy the housing of a lense is similar but the outer lense seems to be bigger) i am only worried about the threads since on the first look they do not seem to be the same size and theese lenses are made for therm app thermal device and i havent seen the thread specs anywhere (they appear to be bigger) :/ i am hoping on implementing something simmilar in to an e4 device without significant housing modifications


this is my video of a test at 150m of a mansize target... if he would be in the woods i would not be able to pick him up and the airsoft gun ranges are at 130m (heavly modified)

plus i havent found anny germanium based lenses yet to be a drop in for e4 there are for ex0 series....

oh and i appolagise for my bad eanglish

As far as I know the E4 does not use a standard size lens mount, so for any alternative lens you will probably need to improvise a mount

[ThermalGuru]

I have been able to locate a Flir E4 in stock with serial number: 6392.76xx.

I would really appreciate if someone can confirm via their own serial number if this is a 1.22.0 firmware or not. 

Thanks!