Poll

Has the hackabiliy of the E4 made you buy one :  

Yes, I was already looking at the competition at a similar price, but the hack swung it to E4
241 (26.5%)
Yes, I'd not considered buying a TIC before, but 320x240 resolution at this price justifies it (as either tool or toy!)
427 (46.9%)
Yes, I was going to buy an E5/6/8 class of unit but will now get the E4
43 (4.7%)
No, but am looking out for a cheap i3 to hack
42 (4.6%)
Not yet, but probably will if now that a closed-box hack becomes is possible
158 (17.3%)

Total Members Voted: 751

Author Topic: Flir E4 Thermal imaging camera teardown  (Read 2668382 times)

0 Members and 2 Guests are viewing this topic.

Offline dmode90

  • Contributor
  • Posts: 18
  • Country: ua
Re: Flir E4 Thermal imaging camera teardown
« Reply #8350 on: December 23, 2017, 03:34:04 pm »
I find something here:
https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg406311/#msg406311
https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg406402/#msg406402

Looks like offset data stored in "/FlashFS/system/calib.rsc" file.
But I do not really understand what kind of code this is, and how to implement it to my e4 to modify this file.
« Last Edit: December 23, 2017, 04:11:33 pm by dmode90 »
 

Offline dmode90

  • Contributor
  • Posts: 18
  • Country: ua
Re: Flir E4 Thermal imaging camera teardown
« Reply #8351 on: December 23, 2017, 03:38:29 pm »
That is why I am such a fan of firmware 1.19. It is intact in all respects.
I have 1.22 firmware. Is it real to downgrade to 1.19 from 1.22?
 

Online Fraser

  • Super Contributor
  • ***
  • Posts: 8537
  • Country: gb
Re: Flir E4 Thermal imaging camera teardown
« Reply #8352 on: December 23, 2017, 06:03:28 pm »
Hi,

1.19 was not released by FLIR as a downlodable firmware file. I do not think downgrading to 1.19 or even the available 1.18 firmware is possible due to FLIR's revised firmware contents. You risk bricking the camera. Such a downgrade will have been discussed in the early pages of this thread as people tried to hack their 1.22 firmware.

Fraser
 
The following users thanked this post: dmode90

Offline dmendesf

  • Contributor
  • Posts: 47
  • Country: br
Re: Flir E4 Thermal imaging camera teardown
« Reply #8353 on: December 26, 2017, 12:55:00 am »
Hi, new user here. Excuse me if my question was answered before but i´m still reading the 334+ forum pages to understand everything... I have a camera with firmware 2.3.0. I bought it used so I don´t know what was done to it before. I tried applying the hacks as explained here:

http://fubar.gr/hacking-the-flir-e4/

Got an error like that:

Traceback (most recent call last):
   File "apply.py", line 90, in <module>
   assert found, "UNKNOWN %s: digest/len is %s" % (name,h)
AssertionError: UNKNOWN conf.cfc: digest/len is 6448

Then looking around I found that the patch expects a conf.cfc of 6608 bytes. Is there anything I can do to hack this camera?
 

Online Bud

  • Super Contributor
  • ***
  • Posts: 3468
  • Country: ca
Re: Flir E4 Thermal imaging camera teardown
« Reply #8354 on: December 26, 2017, 01:43:00 am »
It may have already been hacked. You sure your camera is not 320x240 already ?
Facebook-free life and Rigol-free shack.
 

Offline dmendesf

  • Contributor
  • Posts: 47
  • Country: br
Re: Flir E4 Thermal imaging camera teardown
« Reply #8355 on: December 26, 2017, 02:58:21 pm »
Now I look like a complete fool  :palm:

I just downloaded an image captured with it and indeed it´s a 320x240 one (attached). Is this enough to be sure that the camera was already hacked?

If so I just need to apply the menu hack....
 

Online Fraser

  • Super Contributor
  • ***
  • Posts: 8537
  • Country: gb
Re: Flir E4 Thermal imaging camera teardown
« Reply #8356 on: December 26, 2017, 04:17:50 pm »
FLIR Tools reports that image contains standard 80 x 60 pixel thermal resolution data.

The Ex series cameras upscale the thermal image, when required, to the standard 320 x 240 pixel displayed and stored image size. The saved image resolution specs are not a way to determine the resolution of the thermal image data. The image metadata that FLIR Tools can read provides the information on true resolution.

Your camera is not currently hacked to the full 320 x 240 pixel resolution.

Fraser
« Last Edit: December 26, 2017, 04:23:14 pm by Fraser »
 

Offline dmendesf

  • Contributor
  • Posts: 47
  • Country: br
Re: Flir E4 Thermal imaging camera teardown
« Reply #8357 on: December 26, 2017, 04:33:46 pm »
OK, so back to the beginning... Is there a way to upgrade my camera? This thread has become my night reading, but it´s a big novel... I don´t mind if someone points me to a spoiler  :D
 

Online Bud

  • Super Contributor
  • ***
  • Posts: 3468
  • Country: ca
Re: Flir E4 Thermal imaging camera teardown
« Reply #8358 on: December 26, 2017, 04:56:18 pm »
Try decrypting your config file using cfccfg_v2.py  utility from this post:

https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg594600/#msg594600

and see what is there. Compare with the standard decrypted config.
Facebook-free life and Rigol-free shack.
 

Offline dedelekid

  • Contributor
  • Posts: 9
  • Country: dz
Re: Flir E4 Thermal imaging camera teardown
« Reply #8359 on: December 26, 2017, 07:05:42 pm »
Can someone post this files "T559504%24A.pdf" T559504$A.pdf , if they still had in his archives? thank you.
it will give me a bit of reading .........
 

Offline dmendesf

  • Contributor
  • Posts: 47
  • Country: br
Re: Flir E4 Thermal imaging camera teardown
« Reply #8360 on: December 27, 2017, 03:10:05 am »

Did it and got this:

 #
 # Generated at 2013-10-25 09:37:31
 #
.caps entry
.caps.config entry
.caps.config.name text "GUI E4"
.caps.config.revision text "1.1"
.caps.config.ui entry
.caps.config.ui.fusion entry
.caps.config.ui.fusion.PIP entry
.caps.config.ui.fusion.PIP.enabled bool false
 # ID 63900826
 # CRC03 83c879a6
ޝoáÄtUË€ ¹C¨~9<sYªç`õ·wzfP¦HF9㐶¼oÒ­¨9>^´ój“~â&ø• æSGMÖ®Mª9î7aOžðˆÇ8wÐdýÍ~vTéN¶Q |ÌâÄ0wÚ^üցlC¦ÀëÖ$JU›(÷ K7Øøg‰ˆgmæ°jè;ÝÖÑ´”FD6b„þy>¨


Last line seems very suspicious... Are these the extra bytes that weren´t expected? Can I Just delete them, reencript the file and apply the patch?
 

Online Bud

  • Super Contributor
  • ***
  • Posts: 3468
  • Country: ca
Re: Flir E4 Thermal imaging camera teardown
« Reply #8361 on: December 27, 2017, 03:52:03 am »
It is looking weird to me... Someone messed it up. Post your common_dll.dll file.

Edit:
Quote
Last line seems very suspicious... Are these the extra bytes that weren´t expected? Can I Just delete them, reencript the file and apply the patch?

No do not do that, let us see your common_dll first, if it had been patched or not.
« Last Edit: December 27, 2017, 04:03:22 am by Bud »
Facebook-free life and Rigol-free shack.
 

Offline dmendesf

  • Contributor
  • Posts: 47
  • Country: br
Re: Flir E4 Thermal imaging camera teardown
« Reply #8362 on: December 27, 2017, 11:37:06 am »
Here´s attached the common_dll from /FlashBFS/system/

Thanks for the help.
 

Online Bud

  • Super Contributor
  • ***
  • Posts: 3468
  • Country: ca
Re: Flir E4 Thermal imaging camera teardown
« Reply #8363 on: December 27, 2017, 07:20:36 pm »
This is the factory DLL. However I think you decoded a wrong config file. The one you need is located in FlashFS\system\appcore.d\config.d
Facebook-free life and Rigol-free shack.
 

Offline dmendesf

  • Contributor
  • Posts: 47
  • Country: br
Re: Flir E4 Thermal imaging camera teardown
« Reply #8364 on: December 27, 2017, 09:16:40 pm »
You´re probably right. Here´s the new file... I´m also attaching it if it´s better to analyze. Thanks again.

 #
 # Generated at 2013-10-25 09:37:31
 #
.caps entry
.caps.config entry
.caps.config.name text "app E4"
.caps.config.revision text "1.1"
.caps.config.image entry
.caps.config.image.framegrab entry
.caps.config.image.framegrab.fusion entry
.caps.config.image.framegrab.fusion.enabled bool true
.caps.config.image.framegrab.fusion.pip entry
.caps.config.image.framegrab.fusion.pip.enabled bool true
.caps.config.image.framegrab.fusion.hcf entry
.caps.config.image.framegrab.fusion.hcf.enabled bool true
.caps.config.image.services entry
.caps.config.image.services.store entry
.caps.config.image.services.store.enabled bool true
.caps.config.image.services.store.radiometric entry
.caps.config.image.services.store.radiometric.enabled bool true
.caps.config.image.services.store.incompatible entry
.caps.config.image.services.store.incompatible.enabled bool false
.caps.config.image.services.store.incompatible.level int32 0
.caps.config.image.settings entry
.caps.config.image.settings.enabled bool true
.caps.config.image.settings.IRwidth int32 80
.caps.config.image.settings.IRheight int32 60
.caps.config.image.sysimg entry
.caps.config.image.sysimg.alarms entry
.caps.config.image.sysimg.alarms.enabled bool false
.caps.config.image.sysimg.alarms.measfunc entry
.caps.config.image.sysimg.alarms.measfunc.enabled bool false
.caps.config.image.sysimg.alarms.measfunc.maxCount int32 3
.caps.config.image.sysimg.alarms.humidity entry
.caps.config.image.sysimg.alarms.humidity.enabled bool false
.caps.config.image.sysimg.alarms.humidity.maxCount int32 1
.caps.config.image.sysimg.alarms.insulation entry
.caps.config.image.sysimg.alarms.insulation.enabled bool false
.caps.config.image.sysimg.alarms.insulation.maxCount int32 1
.caps.config.image.sysimg.irMarkers entry
.caps.config.image.sysimg.irMarkers.enabled bool false
.caps.config.image.sysimg.irMarkers.spot entry
.caps.config.image.sysimg.irMarkers.spot.enabled bool false
.caps.config.image.sysimg.irMarkers.spot.maxCount int32 0
.caps.config.image.sysimg.irMarkers.arrow entry
.caps.config.image.sysimg.irMarkers.arrow.enabled bool false
.caps.config.image.sysimg.irMarkers.arrow.maxCount int32 0
.caps.config.image.sysimg.irMarkers.box entry
.caps.config.image.sysimg.irMarkers.box.enabled bool false
.caps.config.image.sysimg.irMarkers.box.maxCount int32 0
.caps.config.image.sysimg.measureFuncs entry
.caps.config.image.sysimg.measureFuncs.enabled bool true
.caps.config.image.sysimg.measureFuncs.diff entry
.caps.config.image.sysimg.measureFuncs.diff.enabled bool false
.caps.config.image.sysimg.measureFuncs.diff.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.diff.calcMask int32 65526
.caps.config.image.sysimg.measureFuncs.isotherm entry
.caps.config.image.sysimg.measureFuncs.isotherm.enabled bool false
.caps.config.image.sysimg.measureFuncs.isotherm.calcMask int32 20
.caps.config.image.sysimg.measureFuncs.isotherm.dual bool false
.caps.config.image.sysimg.measureFuncs.isotherm.fixScale bool false
.caps.config.image.sysimg.measureFuncs.isotherm.interval bool false
.caps.config.image.sysimg.measureFuncs.isotherm.invInterval bool false
.caps.config.image.sysimg.measureFuncs.isotherm.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.mbox entry
.caps.config.image.sysimg.measureFuncs.mbox.enabled bool false
.caps.config.image.sysimg.measureFuncs.mbox.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mbox.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.mcircle entry
.caps.config.image.sysimg.measureFuncs.mcircle.enabled bool false
.caps.config.image.sysimg.measureFuncs.mcircle.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mcircle.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.mline entry
.caps.config.image.sysimg.measureFuncs.mline.enabled bool false
.caps.config.image.sysimg.measureFuncs.mline.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mline.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.reftemp entry
.caps.config.image.sysimg.measureFuncs.reftemp.enabled bool false
.caps.config.image.sysimg.measureFuncs.reftemp.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.reftemp.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.script entry
.caps.config.image.sysimg.measureFuncs.script.enabled false
.caps.config.image.sysimg.measureFuncs.script.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.spot entry
.caps.config.image.sysimg.measureFuncs.spot.enabled bool true
.caps.config.image.sysimg.measureFuncs.spot.calcMask int32 514
.caps.config.image.sysimg.measureFuncs.spot.maxCount int32 1
.caps.config.image.sysimg.visualMarkers entry
.caps.config.image.sysimg.visualMarkers.enabled bool false
.caps.config.image.sysimg.visualMarkers.spot entry
.caps.config.image.sysimg.visualMarkers.spot.enabled bool false
.caps.config.image.sysimg.visualMarkers.spot.maxCount int32 0
.caps.config.image.sysimg.visualMarkers.arrow entry
.caps.config.image.sysimg.visualMarkers.arrow.enabled bool false
.caps.config.image.sysimg.visualMarkers.arrow.maxCount int32 0
.caps.config.image.sysimg.visualMarkers.box entry
.caps.config.image.sysimg.visualMarkers.box.enabled bool false
.caps.config.image.sysimg.visualMarkers.box.maxCount int32 0
.caps.config.image.contadj entry
.caps.config.image.contadj.minSpanFactor entry
.caps.config.image.contadj.minSpanFactor.enabled bool true
.caps.config.image.contadj.minSpanFactor.factorAuto double 2.0
.caps.config.image.contadj.minSpanFactor.factorManual double 2.0
.caps.config.image.targetNoise entry
.caps.config.image.targetNoise.enabled bool true
.caps.config.image.targetNoise.targetNoiseMk int32 135
.caps.config.image.zoom entry
.caps.config.image.zoom.enabled bool false
.caps.config.image.zoom.maxFactor double 1
.caps.config.system entry
.caps.config.system.focus entry
.caps.config.system.focus.laser entry
.caps.config.system.focus.laser.updateFocus entry
.caps.config.system.focus.laser.updateFocus.enabled bool false
.caps.config.ui entry
.caps.config.ui.fusion entry
.caps.config.ui.fusion.PIP entry
.caps.config.ui.fusion.PIP.enabled bool false
.caps.hw entry
.caps.hw.sdcard entry
.caps.hw.sdcard.enabled bool false
 # ID 63900826
 # CRC03 5b4aec95
!ׂ\!Ó§®ƒ¸ú‘ØÊ=S‘ÕI‰4;sé‘ôÌ?½ûÂâ*Y]5)Ï7ªìâÅ+ƒºÔqÿÓ1M¾àËL5ƒßænßËؐ<ØÞõ”‚¿ü1‹²-ß2hÈøÏ|åþn+   Þõ†Ã–•cZLË kÂóÅmã
æ¹ßú½ík ü1߉|(Krh;µ¤µ¹ýT.Eh
 

Online Bud

  • Super Contributor
  • ***
  • Posts: 3468
  • Country: ca
Re: Flir E4 Thermal imaging camera teardown
« Reply #8365 on: December 27, 2017, 10:13:16 pm »
OK that makes sense. So because you got the factory common_dll the first thing you want to do is make a backup copy of it, then use a Hex editor and change the bytes  at offsets 0x53C7 and  0x0AEEDF from E1 to E3. Copy the modified common_dll to the camera.

Then restart the camera and make sure it still starts normally. Then you can edit your decrypted conf, make  IRwidth int32 320, IRheight int32 240,  targetNoiseMk int32 0.
Encrypt it using the cfccgf_v2.py. Copy to the camera. Turn the camera off, remove the battery for a few sec, put back in and restart. This should do the Res mod.
Facebook-free life and Rigol-free shack.
 

Offline dmendesf

  • Contributor
  • Posts: 47
  • Country: br
Re: Flir E4 Thermal imaging camera teardown
« Reply #8366 on: December 28, 2017, 12:59:13 am »

Thank you very much. I did exactly as you said and I think it worked (or at least my delusional brain is seeing more pixels in the attached image :)

I didn´t apply the menu hack yet. Is it safe for my camera?

Aother thing: TSX (I think that´s the name of the blended thermal + visible image) seems to be bugged now. If thermal only is enabled and I switch to TSX I see exactly the same thing as thermal. If visible mode is enabled and I switch to TSX I see exactly the same thing as visible. Did I forgot something?  :(
 

Online Bud

  • Super Contributor
  • ***
  • Posts: 3468
  • Country: ca
Re: Flir E4 Thermal imaging camera teardown
« Reply #8367 on: December 28, 2017, 01:10:34 am »
No it is not good. Try again with the config. Remove the trailing junk before encrypting.
Edit: make sure you use cfccfg_V2
« Last Edit: December 28, 2017, 01:12:45 am by Bud »
Facebook-free life and Rigol-free shack.
 

Offline dmendesf

  • Contributor
  • Posts: 47
  • Country: br
Re: Flir E4 Thermal imaging camera teardown
« Reply #8368 on: December 28, 2017, 01:13:10 am »
Just noticed... I opened both images (FLIR0155 and FLIR0157) with FLIR Tools... the older one is identified a s80x60... newer one shows no info  :-BROKE


Lets try again....
 

Offline dmendesf

  • Contributor
  • Posts: 47
  • Country: br
Re: Flir E4 Thermal imaging camera teardown
« Reply #8369 on: December 28, 2017, 01:28:37 am »
Just to be sure, to encrypt I must use the same script, with the same key but the files in reverse, right?

So:

cfccfg.py 1151d50200581c2b conf.cfg conf.cfc

EDIT: just noticed that you said to use cfccgf_v2.py . I found no such file referenced in this forum.
« Last Edit: December 28, 2017, 01:37:53 am by dmendesf »
 

Online Bud

  • Super Contributor
  • ***
  • Posts: 3468
  • Country: ca
Facebook-free life and Rigol-free shack.
 

Offline dmendesf

  • Contributor
  • Posts: 47
  • Country: br
Re: Flir E4 Thermal imaging camera teardown
« Reply #8371 on: December 28, 2017, 02:13:08 am »
Replying to myself....

I was using cfccfg.py instead of cfccgf_v2.py. Using V2 there´s no trash at the end of the decrypted file. BUT.. still no luck.

When I make changes to conf.cfc the image improves (less noise) but Thermal blending stops working and TSX vanishes from menu (screenshots below). Images captured with the edited conf.cfc aren´t recognized by Flir tools (it shows them but no additional information is given, like the thermal resolution). I´m using the  modified common_dll . I´m sending files by FTP in RNDIS mode. After each update I turn off the camera, take the battery, wait 5 seconds and put it back/turn on. Am I missing something?

I noticed that my configuration file is much shorter than the default hacking script wants. Maybe missing configuration lines? Can someone send me a decrypted conf.cfc for default firmware 2.3.0 so I can check what´s missing?
« Last Edit: December 28, 2017, 02:19:59 am by dmendesf »
 

Online Bud

  • Super Contributor
  • ***
  • Posts: 3468
  • Country: ca
Re: Flir E4 Thermal imaging camera teardown
« Reply #8372 on: December 28, 2017, 02:51:03 am »
Your new config is not getting loaded for some reason, that is why you observing that result.

Try encrypting the original cfg file back with no changes, see if the camera works same way as with the original cfc. This is to test if your encryption works and if the modified common_dll works.

Try adding a proper CRC03.

Try leaving the camera with no battery overnight.

BTW make sure you only have one cfc file in the folder.
Facebook-free life and Rigol-free shack.
 

Offline dmendesf

  • Contributor
  • Posts: 47
  • Country: br
Re: Flir E4 Thermal imaging camera teardown
« Reply #8373 on: December 28, 2017, 02:54:12 am »
Thanks, will try all of this, but what´s a proper CRC03?
 

Offline dmode90

  • Contributor
  • Posts: 18
  • Country: ua
Re: Flir E4 Thermal imaging camera teardown
« Reply #8374 on: December 28, 2017, 03:07:30 am »
Does the sensitivity changing after e4 hack?
And how to check whether it has changed?
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf