Flir E4 Thermal imaging camera teardown

[dmode90]

That is why I am such a fan of firmware 1.19. It is intact in all respects.

I have 1.22 firmware. Is it real to downgrade to 1.19 from 1.22?

[Fraser]

Hi,

1.19 was not released by FLIR as a downlodable firmware file. I do not think downgrading to 1.19 or even the available 1.18 firmware is possible due to FLIR's revised firmware contents. You risk bricking the camera. Such a downgrade will have been discussed in the early pages of this thread as people tried to hack their 1.22 firmware.

Fraser

[dmendesf]

Hi, new user here. Excuse me if my question was answered before but i´m still reading the 334+ forum pages to understand everything... I have a camera with firmware 2.3.0. I bought it used so I don´t know what was done to it before. I tried applying the hacks as explained here:

http://fubar.gr/hacking-the-flir-e4/

Got an error like that:

Traceback (most recent call last):
   File "apply.py", line 90, in <module>
   assert found, "UNKNOWN %s: digest/len is %s" % (name,h)
AssertionError: UNKNOWN conf.cfc: digest/len is 6448

Then looking around I found that the patch expects a conf.cfc of 6608 bytes. Is there anything I can do to hack this camera?

[Bud]

It may have already been hacked. You sure your camera is not 320x240 already ?

[dmendesf]

Now I look like a complete fool 

I just downloaded an image captured with it and indeed it´s a 320x240 one (attached). Is this enough to be sure that the camera was already hacked?

If so I just need to apply the menu hack....

[Fraser]

FLIR Tools reports that image contains standard 80 x 60 pixel thermal resolution data.

The Ex series cameras upscale the thermal image, when required, to the standard 320 x 240 pixel displayed and stored image size. The saved image resolution specs are not a way to determine the resolution of the thermal image data. The image metadata that FLIR Tools can read provides the information on true resolution.

Your camera is not currently hacked to the full 320 x 240 pixel resolution.

Fraser

[dmendesf]

OK, so back to the beginning... Is there a way to upgrade my camera? This thread has become my night reading, but it´s a big novel... I don´t mind if someone points me to a spoiler 

[Bud]

Try decrypting your config file using cfccfg_v2.py  utility from this post:

https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg594600/#msg594600

and see what is there. Compare with the standard decrypted config.

[dedelekid]

Can someone post this files "T559504%24A.pdf" T559504$A.pdf , if they still had in his archives? thank you.
it will give me a bit of reading .........

[dmendesf]

Did it and got this:

#
# Generated at 2013-10-25 09:37:31
#
.caps entry
.caps.config entry
.caps.config.name text "GUI E4"
.caps.config.revision text "1.1"
.caps.config.ui entry
.caps.config.ui.fusion entry
.caps.config.ui.fusion.PIP entry
.caps.config.ui.fusion.PIP.enabled bool false
# ID 63900826
# CRC03 83c879a6
ޝoáÄtUË€ ¹C¨~9<sYªç`õ·wzfP¦HF9㐶¼oÒ­¨9>^´ój“~â&ø• æSGMÖ®Mª9î7aOžðˆÇ8wÐdýÍ~vTéN¶Q |ÌâÄ0wÚ^üցlC¦ÀëÖ$JU›(÷ K7Øøg‰ˆgmæ°jè;ÝÖÑ´”FD6b„þy>¨


Last line seems very suspicious... Are these the extra bytes that weren´t expected? Can I Just delete them, reencript the file and apply the patch?

[Bud]

It is looking weird to me... Someone messed it up. Post your common_dll.dll file.

Edit:

Last line seems very suspicious... Are these the extra bytes that weren´t expected? Can I Just delete them, reencript the file and apply the patch?

No do not do that, let us see your common_dll first, if it had been patched or not.

[dmendesf]

Here´s attached the common_dll from /FlashBFS/system/

Thanks for the help.

[Bud]

This is the factory DLL. However I think you decoded a wrong config file. The one you need is located in FlashFS\system\appcore.d\config.d

[dmendesf]

You´re probably right. Here´s the new file... I´m also attaching it if it´s better to analyze. Thanks again.

#
# Generated at 2013-10-25 09:37:31
#
.caps entry
.caps.config entry
.caps.config.name text "app E4"
.caps.config.revision text "1.1"
.caps.config.image entry
.caps.config.image.framegrab entry
.caps.config.image.framegrab.fusion entry
.caps.config.image.framegrab.fusion.enabled bool true
.caps.config.image.framegrab.fusion.pip entry
.caps.config.image.framegrab.fusion.pip.enabled bool true
.caps.config.image.framegrab.fusion.hcf entry
.caps.config.image.framegrab.fusion.hcf.enabled bool true
.caps.config.image.services entry
.caps.config.image.services.store entry
.caps.config.image.services.store.enabled bool true
.caps.config.image.services.store.radiometric entry
.caps.config.image.services.store.radiometric.enabled bool true
.caps.config.image.services.store.incompatible entry
.caps.config.image.services.store.incompatible.enabled bool false
.caps.config.image.services.store.incompatible.level int32 0
.caps.config.image.settings entry
.caps.config.image.settings.enabled bool true
.caps.config.image.settings.IRwidth int32 80
.caps.config.image.settings.IRheight int32 60
.caps.config.image.sysimg entry
.caps.config.image.sysimg.alarms entry
.caps.config.image.sysimg.alarms.enabled bool false
.caps.config.image.sysimg.alarms.measfunc entry
.caps.config.image.sysimg.alarms.measfunc.enabled bool false
.caps.config.image.sysimg.alarms.measfunc.maxCount int32 3
.caps.config.image.sysimg.alarms.humidity entry
.caps.config.image.sysimg.alarms.humidity.enabled bool false
.caps.config.image.sysimg.alarms.humidity.maxCount int32 1
.caps.config.image.sysimg.alarms.insulation entry
.caps.config.image.sysimg.alarms.insulation.enabled bool false
.caps.config.image.sysimg.alarms.insulation.maxCount int32 1
.caps.config.image.sysimg.irMarkers entry
.caps.config.image.sysimg.irMarkers.enabled bool false
.caps.config.image.sysimg.irMarkers.spot entry
.caps.config.image.sysimg.irMarkers.spot.enabled bool false
.caps.config.image.sysimg.irMarkers.spot.maxCount int32 0
.caps.config.image.sysimg.irMarkers.arrow entry
.caps.config.image.sysimg.irMarkers.arrow.enabled bool false
.caps.config.image.sysimg.irMarkers.arrow.maxCount int32 0
.caps.config.image.sysimg.irMarkers.box entry
.caps.config.image.sysimg.irMarkers.box.enabled bool false
.caps.config.image.sysimg.irMarkers.box.maxCount int32 0
.caps.config.image.sysimg.measureFuncs entry
.caps.config.image.sysimg.measureFuncs.enabled bool true
.caps.config.image.sysimg.measureFuncs.diff entry
.caps.config.image.sysimg.measureFuncs.diff.enabled bool false
.caps.config.image.sysimg.measureFuncs.diff.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.diff.calcMask int32 65526
.caps.config.image.sysimg.measureFuncs.isotherm entry
.caps.config.image.sysimg.measureFuncs.isotherm.enabled bool false
.caps.config.image.sysimg.measureFuncs.isotherm.calcMask int32 20
.caps.config.image.sysimg.measureFuncs.isotherm.dual bool false
.caps.config.image.sysimg.measureFuncs.isotherm.fixScale bool false
.caps.config.image.sysimg.measureFuncs.isotherm.interval bool false
.caps.config.image.sysimg.measureFuncs.isotherm.invInterval bool false
.caps.config.image.sysimg.measureFuncs.isotherm.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.mbox entry
.caps.config.image.sysimg.measureFuncs.mbox.enabled bool false
.caps.config.image.sysimg.measureFuncs.mbox.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mbox.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.mcircle entry
.caps.config.image.sysimg.measureFuncs.mcircle.enabled bool false
.caps.config.image.sysimg.measureFuncs.mcircle.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mcircle.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.mline entry
.caps.config.image.sysimg.measureFuncs.mline.enabled bool false
.caps.config.image.sysimg.measureFuncs.mline.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mline.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.reftemp entry
.caps.config.image.sysimg.measureFuncs.reftemp.enabled bool false
.caps.config.image.sysimg.measureFuncs.reftemp.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.reftemp.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.script entry
.caps.config.image.sysimg.measureFuncs.script.enabled false
.caps.config.image.sysimg.measureFuncs.script.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.spot entry
.caps.config.image.sysimg.measureFuncs.spot.enabled bool true
.caps.config.image.sysimg.measureFuncs.spot.calcMask int32 514
.caps.config.image.sysimg.measureFuncs.spot.maxCount int32 1
.caps.config.image.sysimg.visualMarkers entry
.caps.config.image.sysimg.visualMarkers.enabled bool false
.caps.config.image.sysimg.visualMarkers.spot entry
.caps.config.image.sysimg.visualMarkers.spot.enabled bool false
.caps.config.image.sysimg.visualMarkers.spot.maxCount int32 0
.caps.config.image.sysimg.visualMarkers.arrow entry
.caps.config.image.sysimg.visualMarkers.arrow.enabled bool false
.caps.config.image.sysimg.visualMarkers.arrow.maxCount int32 0
.caps.config.image.sysimg.visualMarkers.box entry
.caps.config.image.sysimg.visualMarkers.box.enabled bool false
.caps.config.image.sysimg.visualMarkers.box.maxCount int32 0
.caps.config.image.contadj entry
.caps.config.image.contadj.minSpanFactor entry
.caps.config.image.contadj.minSpanFactor.enabled bool true
.caps.config.image.contadj.minSpanFactor.factorAuto double 2.0
.caps.config.image.contadj.minSpanFactor.factorManual double 2.0
.caps.config.image.targetNoise entry
.caps.config.image.targetNoise.enabled bool true
.caps.config.image.targetNoise.targetNoiseMk int32 135
.caps.config.image.zoom entry
.caps.config.image.zoom.enabled bool false
.caps.config.image.zoom.maxFactor double 1
.caps.config.system entry
.caps.config.system.focus entry
.caps.config.system.focus.laser entry
.caps.config.system.focus.laser.updateFocus entry
.caps.config.system.focus.laser.updateFocus.enabled bool false
.caps.config.ui entry
.caps.config.ui.fusion entry
.caps.config.ui.fusion.PIP entry
.caps.config.ui.fusion.PIP.enabled bool false
.caps.hw entry
.caps.hw.sdcard entry
.caps.hw.sdcard.enabled bool false
# ID 63900826
# CRC03 5b4aec95
!ׂ\!Ó§®ƒ¸ú‘ØÊ=S‘ÕI‰4;sé‘ôÌ?½ûÂâ*Y]5)Ï7ªìâÅ+ƒºÔqÿÓ1M¾àËL5ƒßænßËؐ<ØÞõ”‚¿ü1‹²-ß2hÈøÏ|åþn+   Þõ†Ã–•cZLËkÂóÅmã
æ¹ßú½ík ü1߉|(Krh;µ¤µ¹ýT.Eh

[Bud]

OK that makes sense. So because you got the factory common_dll the first thing you want to do is make a backup copy of it, then use a Hex editor and change the bytes  at offsets 0x53C7 and  0x0AEEDF from E1 to E3. Copy the modified common_dll to the camera.

Then restart the camera and make sure it still starts normally. Then you can edit your decrypted conf, make  IRwidth int32 320, IRheight int32 240,  targetNoiseMk int32 0.
Encrypt it using the cfccgf_v2.py. Copy to the camera. Turn the camera off, remove the battery for a few sec, put back in and restart. This should do the Res mod.

[dmendesf]

Thank you very much. I did exactly as you said and I think it worked (or at least my delusional brain is seeing more pixels in the attached image

I didn´t apply the menu hack yet. Is it safe for my camera?

Aother thing: TSX (I think that´s the name of the blended thermal + visible image) seems to be bugged now. If thermal only is enabled and I switch to TSX I see exactly the same thing as thermal. If visible mode is enabled and I switch to TSX I see exactly the same thing as visible. Did I forgot something? 

[Bud]

No it is not good. Try again with the config. Remove the trailing junk before encrypting.
Edit: make sure you use cfccfg_V2

[dmendesf]

Just noticed... I opened both images (FLIR0155 and FLIR0157) with FLIR Tools... the older one is identified a s80x60... newer one shows no info 


Lets try again....

[dmendesf]

Just to be sure, to encrypt I must use the same script, with the same key but the files in reverse, right?

So:

cfccfg.py 1151d50200581c2b conf.cfg conf.cfc

EDIT: just noticed that you said to use cfccgf_v2.py . I found no such file referenced in this forum.

[Bud]

See this post

https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg596959/#msg596959

[dmendesf]

Replying to myself....

I was using cfccfg.py instead of cfccgf_v2.py. Using V2 there´s no trash at the end of the decrypted file. BUT.. still no luck.

When I make changes to conf.cfc the image improves (less noise) but Thermal blending stops working and TSX vanishes from menu (screenshots below). Images captured with the edited conf.cfc aren´t recognized by Flir tools (it shows them but no additional information is given, like the thermal resolution). I´m using the  modified common_dll . I´m sending files by FTP in RNDIS mode. After each update I turn off the camera, take the battery, wait 5 seconds and put it back/turn on. Am I missing something?

I noticed that my configuration file is much shorter than the default hacking script wants. Maybe missing configuration lines? Can someone send me a decrypted conf.cfc for default firmware 2.3.0 so I can check what´s missing?

[Bud]

Your new config is not getting loaded for some reason, that is why you observing that result.

Try encrypting the original cfg file back with no changes, see if the camera works same way as with the original cfc. This is to test if your encryption works and if the modified common_dll works.

Try adding a proper CRC03.

Try leaving the camera with no battery overnight.

BTW make sure you only have one cfc file in the folder.

[dmendesf]

Thanks, will try all of this, but what´s a proper CRC03?

[dmode90]

Does the sensitivity changing after e4 hack?
And how to check whether it has changed?

[Bud]

but what´s a proper CRC03?

It is the value in the last row in your config file. There was an executable posted in this thread to calculate it, you will have to find it. However the properly patched common_dll eliminates the need for it and CRC03 can be left unchanged.