Flir E4 Thermal imaging camera teardown

[tomas123]

Flir saled different hardware versions of E30 (the first model miss a real camera)

user funzt successful upgraded an E30 with  ID 490xxxxx 

https://www.eevblog.com/forum/profile/?area=showposts;u=89829

thx Taucher
I put my E60 file as template.cfg in your great EzCRC01-V01-static
and that works!!!
and my E30 accepted it --> 
now work with ui.d and wlan.....

there is a better thread for your questions:
https://www.eevblog.com/forum/thermal-imaging/flir-e40-upgrade-configuration/
Flir E40 Upgrade & Configuration

[mct75]

ROC is inherent to the lack of steps in the hacking procedure apllied to the cameras which are inconsistent to certain firmware| software versions combinations. If it came once, it will come again. Typically, after extended use of camera, or over-warming. Suspected versions according my experience are: 2.3.0, 2.8.0 and the downgraded.   

Interesting!   I had attributed it to the menu hack, but I also used it for like 45 minutes straight staring at my urine in the toilet bowl (my girlfriend thinks I am weird now)

Is there a recourse for preventing the ROC?  I read some of the posts which had some success.  My camera has a calibration date of 03/07/2016 so I highly suspect it was downgraded before I got it (it was used and resolution hacked when it arrived)

[Solare]

It might be possible to recover, if you have the original files.

What was your original firmware version, do you know? I cannot tell unless you tell you serial, which is not welcome here for a reason, but my guess is that you might have 2.11. What is the version now, as read in the Menu?

[mct75]

The version now is 2.3.0, model is E4 1.2L, calibration is 2016-03-07, serial starts with 63975xxx (if that's the right amount of information)

Since mine came hacked, I have no copies of the "pure" files but I did make a backup of the files as they are on the camera now.   Not sure how much of a help that is.  So far the ROC has only happened once, I don't know if some get it more than others.

[DoricLoon]

Hello Forum,

I've been keen on getting a thermal imager for a while now but felt it hard to justify the price of a decent one. The ability to upgrade the E4 to 320x240 definately swings the balance for me.
I had ordered an E4 from ebay with the intention of carrying out the mod. After ordering it I asked the vendor which firmware version the unit carried. Happily he responded with V2.3.0 which has clear and proven upgrade path  The following morning while rumaging through the posts in this thread I saw a bit about discounted units with lower sensitivity and temperature range. Immediate panic button went (lower spec model under the same model name?) Checked the ebay listing again and sure enough, not in the description but in the E4 spec table which followed the listing were the reduced (non standard) specs  Fortunately the seller was willing to cancel and refund.  So beware of cheaper than normal E4's there could be a nasty surprise.

So my question is this. Since the E5 is now available at the same price as the E4 (£723 @RSWWW) do all of the hacks work equally well on the E5?

I haven't seen any mention of firmware beyond 2.11 so presumably all existing models have (by the hard work of others  ) the ability to be upgraded. Just thought that if sensor quality control goes on a sliding scale dependent on the model? Hacking the E5 rather than the E4 has less chance of dead pixels?

[Solare]

 

This is definitely 2.11.0 downgraded to 2.3.0 and then hacked the one you have there. It is known to have ROC, and, although can be manually tuned to remove it, this requires individual work with given camera (not trivial or reproducible solution, sorry).

The best option for you might be rollback to the 2.11.0 and try it with the new procedure discovered by 2 pls. So far, people do not report ROC after it.

Good luck!

[mct75]

This is definitely 2.11.0 downgraded to 2.3.0 and then hacked the one you have there. It is known to have ROC, and, although can be manually tuned to remove it, this requires individual work with given camera (not trivial or reproducible solution, sorry).

Is this tuning more skilled or just laborious?  I have some free time, but I'm still pretty new to WinCE hacking.

The best option for you might be rollback to the 2.11.0 and try it with the new procedure discovered by 2 pls. So far, people do not report ROC after it.

Good luck!

Is the upgrade something that can be reverted?  I know people have downgraded before (obviously mine was downgraded) but is there any extreme risk to it?  I'm very much a "measure twice cut once" type of guy when it comes to this stuff.




This reminds me of the PSP hacking scene back in 2005.  Everyone wanted software version 1.50 and went to great lengths to get a unit with that version.  Then the epic cat-and-mouse game began with Sony who kept patching exploit holes and locking people out of games until they updated.  The hackers would take the official firmwares, and patch them to still allow unsigned code.  Having a fully patched and homebrew capable PSP was a source of pride. 

The PSP was a device that had so much potential, but Sony wasted it on trying to force people to buy crappy ports and movies they already owned on a $30 UMD that only played in the PSP.  The homebrew scene was way more fun.  Ironically I spent most of my time playing Gameboy games on an emulator an listening to internet radio.   They even got it to boot Windows 95.   

Eventually the hackers figured out that there was a factory menu activated by an eeprom inside the battery of all things and the mystique of using exploits and patching custom firmwares disappeared.   But still, the real heroes were the homebrew software developers that really unlocked the potential of the PSP, just like the folks here are doing with the E4.  Brings a tear to my eye.

[Solare]

Everything can be done with a proper treatment, some amount of time, certain skills and knowledge and lots of will So you are not forbidden to try your best! Just be aware people here including me cannot really help you if something goes wrong.

What I am saying is that it is not a matter of patching something or updating few files or changing a string or too, i.e., it is not reproducible and shareable easily. You may be aware already that some files are specific to your camera, which means, cannot be shared, but only carefully edited with understanding each step and its effect on the camera, and controlling every loop and every branching of possibilities, and adjusting your hacking accordingly. Truly, this is really manual, individual and personal hacking, which is so much unlike "patch and go" hack we have here with E4 - E8+

That's why, I strongly recommend you to find original files from your camera and restore them, and them proceed as advised.

If this is absolutely impossible, try upgrading your camera back to 2.11.0. and re-apply the hacks (modified procedure and files for the 2.11.0). That may not work though, if some of original files is missing. In this case, ROC will persist.

You are on your own here, so take your risk responsibly!



 

[mct75]

I guess I don't understand what is happening well enough to go and make changes!   To me, that the camera works great until it's restarted while warm indicates that it has all the calibration it needs to function properly.  Still, not having the original files worries me.

[mct75]

I used the "2lps" method and was able to upgrade to 2.11 and apply the reshack, as well as keep some of the advanced menu options.

What I did, basically (not to imply these methods are anything I came up with) was:

• remove "permament" RNDIS mode (I had left it on)
• update FLIR tools (it won't allow an update of the camera until you update tools)
• from the update camera menu, I manually specified the 2.11 files (might not be required unless you're downgrading)
• flash 2.11.  I lost both the menu hack and the res hack on mine
• go back into permament RNDIS mode, reboot
• use Filezilla to apply the 2lps common_dll.dll file
• remove RNDIS mode
• reboot and have reshack and some extra menu options

So far I haven't seen the ring of crap, but I suspect it's indeed fixed if 2lps had success with it.   I'm pretty miffed about the lack of the more advanced menu options.  Ironically I liked the "no display" option the most, as there was nothing on the screen but the image.  Less stuff to distract me.  If there's a way to remove the FLIR logo and temperature scale I'd consider 2.11 to be a real winner.

[mct75]

Well, I broke it.

I decided to downgrade to 2.3.0 to experiment with the Ring of Crap some more, and when I did I managed to get 80x60 and ROC at the same time.  Totally not fair.  I did the reshack python script and it's still stuck at 80x60 on 2.3.0.  Tried uploading my backed up common_dll.dll (that was working on 2.3.0 when I got the camera) and no change.  Defeated, I went back to 2.11.0 and now that is at 80x60 too, and 2lps's patched common_dll.dll isn't even fixing that.   

[2lps]

With 2.11 firmware:

1. Upload the backup of your conf.cfc to /FlashFS/system/appcore.d/config.d/
2. Upload common_dll.dll (downloaded from my URL) to /FlashBFS/system/
3. For the menu hack, upload the ui_control.rsc (I sent you a message with a download URL) to /FlashBFS/system/appcore.d/factory.d/
4. Restart

It is safe to execute the hacks when you have the original conf.cfc. Yours is already patched and I am not sure what happens when you try to patch it again. This is why I am sending you individual files, extracted from the hacks.

[2lps]

Step 3 from my previous post is when you already have the menu hack applied. E.g. you applied it on 2.3.0 and then upgraded to 2.11. It will work based on when you made the backup of conf.cfc - before you applied the menu hack or after it.

If your backup of conf.cfc is before the menu hack, then instead of copying an individual file in step 3, just apply the complete menu hack again.

[mct75]

My 2.11 upgraded camera had no config.d directory inside appcore.d, but I copied it over from a backup of the original files that were on my camera when I got it.   Sadly I'm still stuck at 80x60 even with the new common_dll.dll.

[2lps]

Are you sure that you are looking at the correct folder?

There is FlashFS and there is FlashBFS. The conf.cfc is inside /FlashFS/system/appcore.d/config.d/
There is also /FlashBFS/system/appcore.d/, where there is no config.d folder, which is fine.

The only thing in common_dll.dll is the removed signature checks for the conf.cfc. I think there is a manual method, where you can decrypt conf.cfc, make the necessary modifications, re-calculate the CRC and encrypt it back. The original 2.3.0 automated hack had problems with CRC recalculation, and that is why there was need to patch the common_dll.dll.

The resolution and some of the advanced menu options are in conf.cfc and if you have problems with a patched common_dll.dll (given that you copied it to the correct place), then there is problem with conf.cfc.

[mct75]

This makes a lot of sense.  I was definitely working with FlashBFS instead of FlashFS.

Does anyone know what the B stands for?  I get the "flash filesystem" part, but what is the B?

Thank you so much for your help so far, I'm slowly getting the hang of this stuff!   How long until someone ports Linux to the E4?   Now that would be fun!

[mct75]

That did it!  I moved the conf.cfc from the camera as it arrived to me (unknown lineage but with a working reshack on 2.3.0) to /FlashFS/system/appcore.d/config.d/

I've still got the limited menu set, but I'm going to look at the ui_control.rsc file some more.  At least it's plain text.  Holy grail for me will be the removal of the flir logo and scale bar when "no measurement" is selected.  The color pallets are nice to have too. 

Can the conf.cfc be decrypted anymore?  I tried ftool.exe and got an error.

[2lps]

Probably for the menu, you can just apply the menu hack.

The ftool is for the 1.x version of conf.cfc. For 2.x you can use cfccfg_V2: https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg596959/#msg596959 (there is a link to the original post of how to use it - https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg594600/#msg594600)

To get your SUID:
0. Put the camera into RNDIS mode
1. Open the command prompt and telnet to the camera:
telnet 192.168.0.2

You will gain access to the FLIR Command Line Interpreter

2. CD to FlashFS/system/

\>cd FlashFS/system/

3. Execute suid.exe
\FlashFS\system\>suid

The SUID necessary for cfccfg_V2.py will be printed.

[mct75]

Very cool!  Thank you.   It's nice to see what the conf.cfc actually has in it.    I see that my serial number and a "CRC03" are at the very bottom, then a line of a bunch of gibberish.   The rest of it is very plaintext though.

[Lazarus4_]

Hello.

I applied the Res and Menu hack from 2lps on my E4 @ FW 2.11.0.
Everything worked just fine. The only problem I got is that after the Menuhack
the FLIR imprint on the pictures I take isn´t  visible anymore. Still I would like to have the
logo in every picture I take. Is there any way to make this possible again?

I tried the command "> rset .ui.userSettings.overlayLogo true" via telnet but it shows "bad data" as a result.
Anyone can help me?

THX

[electr_peter]

I noticed that E4 camera have frozen 2 times already. Picture froze, buttons did not respond. Holding power key restarted camera. Camera froze at seemingly random times (possible at calibration stage), otherwise 99.9% of time works fine. Device E4+ with 2.11 FW

Question - is there a way to know what caused this issue? Is there a log for failures in internal files?

[mct75]

Mine has locked up a few times.  It will either:

• Pop up a modal box saying appcore.exe had to shut down
• Go to a solid white screen
• Sometimes the pixels will go full-scale 'hot', usually creeping from top to bottom

However, my camera is heavily molested so some of that may be my error.

[electr_peter]

mct75, symptoms you described does not fit in my case. Camera just froze in operation, still showing last frame with coloured thermal pattern and markers - no extra weird behaviour was noticed.

[Lunasix]

Great post !

I have applied the hack with success, and increase in quality is impressive. Thanks.

[godfrey]

Having a few major issues.

A couple of years ago, I bought two E4's with 1.22 firmware.  One was easily and successfully modified back then, the other sat, until tonight.  I followed the instructions, but for whatever reason -- the images look jagged and half the menu items are missing...spot measurement, msx, etc...not to mention, it no longer shows up as a webcam when connected to my MacBook Pro (factory 1.22 did). 

I edited the conf.cfc file without issues.  I imported the menu3beta (or whatever the file is called) -- and while it looks slightly better, it doesn't look anywhere near what the other looked like, and certainly doesn't look like my E60.


Is there a way I can either revert back to the original 1.22 firmware and start over or move to a newer version and go from there?


Getting desperate -- have to ship this out soon to a friend who I'm donating it to.


Any help would be greatly appreciated.



Phil