Flir E4 Thermal imaging camera teardown

[gemrough]

I also ordered early Monday morning (around 9am est)..... I guess I will call tomorrow and see what is up. I see the charge pending on my credit card. 

[supermikel]

Hi,

i want to ask about any Progress with Respekt to a Menue hack for the  E4. Manual Temp.range Setting, and different palettes are Feature i dream on. Is there any Menue hack available?

Thanks

Mikel

[viacom1]

If you go on the website you can see that you guys bought out their entire inventory.  Some will be delayed a few days I'm sure.

Ordered from Zoro yesterday and order still shows "Pending Approval".... I'm starting to wonder if they are going to honer the 30% off coupon....

[sidewinder770]

Well much to my surprise it showed up at my door this morning! Looks like it shipped from IL and I'm in MI so it got here next day. I did the update and all went well- 320x240 now! FW version 1.2 and SW 3.2.0

Does anyone have the files and procedures for eliminating the flir logo and getting the other palettes? There was link to file from 2 weeks ago but they are no longer there. Any help would be great- Thanks!

[janekivi]

Nothing new so far...
2.3.0_Menu_3.zip

[sidewinder770]

Thanks- that did the trick and easy to do!

[skarabas]

Thanks- that did the trick and easy to do!

Im in the same boat sidewinder...  Literally, from Michigan, ordered it from zoro with the discount, got it today.  The resolution hack worked, but the menu thing isn't taking.  In fact I am losing all my menus/button fuctionality when I run it.  What did you do to get them to work right? 

[sidewinder770]

All I did was run the 2.3.0_menu_upgrade.fif from the FLIRInstallNet application. It restarted and the additional color palettes were there and the logo was gone- no problems at all. Where in MI are you?

[skarabas]

grand rapids.

I must have disconnected the flir before it was done injecting the fif (I was getting impatient at that point).  Tried it again and it worked out fine.  The only thing I'm missing (I don't think the new FW is compatible with it yet) is the ability to manually enter temp scales.  But I can survive without it.

And a big heads up for anyone else with the new firmware, for some reason or other (at least for me) windows 8.1 doesn't set up the network options properly and even manually entering the IP and Gateway doesn't work.  Tried three different windows 8.1 pcs and about a dozen usb ports with zero luck.  I ended up digging out an old windows 7 laptop and everything worked perfectly on the first try.

[Northdynamic]

Thanks  janekivi!

Just ran the menu upgrade on my 2.3, now I have full resolution and added pallets; one step closer to full unlock!

[Co6aka]

Been fiddling with a v2.3 cam for about an hour now... Cannot get past the "150 File status okay; about to open data connection" message; just hangs there and that's that. IP comes right up, login is successful, but...

SOLUTION: Re-checked Win-Firewall and a SECOND entry is now present for FTP, and after enabling access for the new entry everything worked. Prolly that's the cause behind the trouble people have been having.

[Myrulken]

Hello all.
I have a FLIR E4 before me that i bought yesterday and that has been slightly used, and my question is this: Can you somehow tell if this unit has been hacked? Does it show anywhere in the system? The startup screen seems normal, but in the specs in the camera it says "Model - E4, i was thinking that this might change once you've upgrade it?
If it isn't hacked i will do it, but it's quite unnecessary if it's already been hacked...

Its a fairly new unit so the software is 2.3, btw..

[Chanc3]

Hello all.
I have a FLIR E4 before me that i bought yesterday and that has been slightly used, and my question is this: Can you somehow tell if this unit has been hacked? Does it show anywhere in the system? The startup screen seems normal, but in the specs in the camera it says "Model - E4, i was thinking that this might change once you've upgrade it?
If it isn't hacked i will do it, but it's quite unnecessary if it's already been hacked...

Its a fairly new unit so the software is 2.3, btw..

It's highly unlikely that it is, but you can check the outputted images, which will indicate what the resolution is.

[Myrulken]

If i open this in Linux GIMP, it says: Image size 320x240 , but in another line it says that resolution is: 72x72 DPI? 

[KK]

If you go on the website you can see that you guys bought out their entire inventory.  Some will be delayed a few days I'm sure.

Ordered from Zoro yesterday and order still shows "Pending Approval".... I'm starting to wonder if they are going to honer the 30% off coupon....

I was surprised to get a 1.2 firmware from Zorro. But, I am pleased.

[Chanc3]

If i open this in Linux GIMP, it says: Image size 320x240 , but in another line it says that resolution is: 72x72 DPI? 


EDIT: If i'm not mistaken it should be hacked, if you look to the picture res?

 I'll ask the seller later and how he did it and report back!

Open the image in FLIR Tools and check what the IR resolution reports as:

[Fraser]

To my eyes that sample image looks to have 80x60 thermal resolution. i.e it has not been hacked.

Aurora

[Myrulken]

Big thank you for the replies.

The device was not hacked, but now it is! I just followed the steps in the guides here and it worked like a charm. Thank you for making this possible!

If someone having difficulties with the steps in the guide, drop me a PM and i'll try to help you 

[tomas123]

Can you somehow tell if this unit has been hacked? Does it show anywhere in the system?

To my eyes that sample image looks to have 80x60 thermal resolution. i.e it has not been hacked.

Aurora

yes

Code: [Select]

>exiftool -RAW* FLIR0016.jpg
Raw Value Median                : 10220
Raw Value Range                 : 432
Raw Thermal Image Width         : 80
Raw Thermal Image Height        : 60
Raw Thermal Image Type          : PNG
Raw Thermal Image               : (Binary data 5566 bytes, use -b option to extract)

[comanche3]

switch to thermal image only - no msx and post a picture of your hand, so we can tell you if you have high resolution

[Bud]

A unhacked camera has a lot of visible noise, just close the lens cover and you will see it all dancing all over the background.

[tomas123]

Which firmware suggest the Flir tools updater for the old E4 with a FW 1.19 (the first version with a plain text config file and simple crc01 checksum)?

What is happened by a firmware update from a old un-crypted 1.19 to current firmware?
Persists the old plain text config file with simple CRC01 check?

If yes, why we cant simple hack the current FW with an old plain text CRC01 config file?
Are there additional entries in EEPROM of newer cameras ?

[TurboTom]

Which firmware suggest the Flir tools updater for the old E4 with a FW 1.19 (the first version with a plain text config file and simple crc01 checksum)?

What is happened by a firmware update from a old un-crypted 1.19 to current firmware?
Persists the old plain text config file with simple CRC01 check?

If yes, why we cant simple hack the current FW with an old plain text CRC01 config file?
Are there additional entries in EEPROM of newer cameras ?

Hi Tomas -

the FLIR Updater suggests the currently latest Version 2.3.0 for a 1.19.8 camera (been there, done that). The update procedure itself ends with an error (though I forgot what it actually says). After the update, the firmware of the camera is reported as "2.3.0*", whatever the asterisk means... All the config files stay unencrypted and the "simple" hack for the 1.19.8 still works. Yet, the menu extension won't since FLIR seems to have removed some of the functions from appcore and facet.rcc doesn't contain all the required modules anymore. I was able to assemble a "special" facet.rcc with the help of some of this forum's members that will return most of the menu extensions of the old hack, but the manual temperature range adjustment was one of the functions that wouldn't work. Also most of the extended web configuration menu items would only report something like "This function is not supported".

Examinations and comparisons between the camera backup and OEM update packages showed that the updater replaces the operating system and most files in FlashBFS. Some config files stay untouched as well as the defect management (obviously). CRC01 check for the config files is kept.

With a "home-brewn" 1.19.8 update package (which apparently doesn't exist publicly available from FLIR), I was able to revert my camera back to 1.19.8 with the updater once again terminating at 96% with an error message. After the "downgrade" the camera reported a software configuration ">0.1.1"  or something like this. To finally get this sorted, I had to manually replace the two files in  \flashBFS\system\kits.d\ "appkit.rev" and "prodkit.rev" with the ones from my old backup.

There must be some additional software layer (or maybe even hardware coding) that reports to appcore what config file format it should expect and that renders an old software configuration inoperational. This could be the bootloader which was the only file where the version number didn't change throughout this "journey". Yet, I failed to locate the bootloader, maybe it's residing in a hidden partition of the flash memory? Maybe if we would be able to locate and access the bootloader, we could up/downgrade the camera as we like.

About the EEPROM structure and if it was changed on generic 2.x.y cameras I haven't got any information. All that I can tell is that on my camera, the EEPROM access password stayed "1235" even after the update.

Maybe this information is some food for thoughts regarding a possible "downgrade" of later camera versions.

Cheers,
Thomas

[tomas123]

great answer 

Thank You

All the config files stay unencrypted and the "simple" hack for the 1.19.8 still works.

as expected, Flir now use the eeprom as dongle
so that newer E4 can't down step to unencrypted config files

[janekivi]

As I wrote here before, you can play with old software in new 2.3.0 1.2L E4 and it loads plain text conf.cfc files. This is not problem. I took some files from flir_ex_pn639_v1.18.7_update_pack.
There is few changes in windows files and who knows what it checks for booting... that's why I'm not test yet full
software downgrade.