Flir E4 Thermal imaging camera teardown

[Kim_555]

In order not to mix all the messages together, I will write a separate message. I prepared a file - conf.cfc using the conf.cfg file from the video and the method of updating the camera with firmware 3. 16 I also found such a file in the camera backup, it had a completely different structure there, and at the end of the file there was neither a serial number nor a checksum, and the beginning of the file was also completely different. Someone seriously worked on this camera in the past


\FlashFS\system\service\appcore.d\config.d\conf.cfg - path in camera backup

#
# Generated at CONFIG_DATE CONFIG_TIME
#
.caps entry
.caps.config entry
.caps.config.name text "app prodconvconf_std"
.caps.config.revision text "999.9KaKaOnly"
,
,
.caps.config.system.focus.laser entry
.caps.config.system.focus.laser.updateFocus entry
.caps.config.system.focus.laser.updateFocus.enabled bool true


Actually, the question is, can I also try to upload this prepared file to the camera? What to do with common_dll.dll? Or is this file not needed, the original?


P.S. Yes, this is a working option, and I restored the camera with a resolution of 320 * 240, on firmware 2.3. Now there is no point in returning the camera.

[Fraser]

Kim_555.

My reply to your post was unfair to you so I deleted it.

I likely have the 1.22 update file but I do not hold an image of an unmodified 1.22 file system. I will look in my archive.

Fraser

[Fraser]

I have checked and sadly I have only the 1.21 update and not 1.22. Sorry that I cannot help

Fraser

[Kim_555]

Yes, I have already fixed it. I described my thought process above, Anyway - thanks

[asp]

Guys, does anyone still have the TIConfig by Marphy? I want to use it on 1.21. I can't seem to find it anywhere

[ThatGuy1990]

Can somebody please post a proper link with all the appropriate files to the 3.16 software hack. The guide is incomplete. I’m missing the CR03 file. Think I was able to find the rest. Is it possible to find a revised guide and alll the proper files in a nice easy location. Or at least tell me what page number of this thread I need. Thanks.

[Bud]

Looking at it, height and width define the respective dimensions of the measurement box, and x and y define the coordinate of left top corner of the box (Assuming the thermal screen in your case is 320x240).
If you want to resize the measurement box , then specify  width and height (not exceeding 320x240), and in x/y specify position of the left top corner in pixel units. The respective dimensions must not exceed 320/240 limits, otherwise the camera software will catch it and will apply no change.

[Bud]

Lets illustrate using OP's setup, assuming the box is positioned in the center of the 320x240 screen:

.x + .width + .x = 106+107+106 = 319
.y + .height + .y = 82+75+82 = 239

So the box and margins fit 320x240 pixels.

You specify the y from left Top coner by the way, this is how it commonly is.

[Bud]

Look at the formula above. You have to change all 4 coordinates and make sure the respective sums stay within 320x240 boundary.

[Bud]

Are you using a liberated camera or a stock one?

[Bud]

Did you try cold boot by removing the battery after you changed the template?

[tske]

Are there any hacking difficulty difference among those "hardened" firmware versions (v1.21 all the way to v3.16)?

[tske]

How to disable correction for lens geometric distortion?

[KONNEX]

I see the a listing on ebay for remote upgrade as a service.
the interessting part for me is how they change the identification of the camera e.g. from e4 to e8 and unlock xt?
Maybe i missed something in the days but form my memories there was no further info in that in this board?!

[Mavro]

Checking back in after a long while... I have an E4 running the resolution hack back on 1.18.8 -- is there any reason to update the firmware?  it seems to work great... what am I missing by keeping it on 1.18.8?

[Fraser]

A camera running 1.18.8 still has its service menu present and functional. For this reason I would not wish to upgrade to later firmware that was mostly designed to hamper attempts to upgrade the Ex series cameras and provide support for changes in later cameras Hardware revision. A camera with 1.18 or 1.19 firmware is so easy to reconfigure/modify and it dates back to 2013 so you never know when the service menu will come in handy, such as if new dead microbolometer pixels appear. I had an E4 and stayed on firmware 1.19 but applied the resolution upgrade and added additional menu options.

Fraser

[adam3914]

So i bought a broken flir "e5-xt" on ebay.  It turned out to be an older camera in a new flir e5-xt box.  It had the serial number removed from the battery compartment.  I assume it was an amazon return scam.  I am not even sure its a flir e5, maybe the faceplates were swapped as well. 

It was broken in a way that it would freeze during startup on the flir logo.  I was still able to get into the file system and it looks like someone tried to install the 3.16 firmware from the newer cameras.  I also discovered a common_dll_org.dll file so it looked like someone tired to upgrade the camera in the past.

I was able to load the 2.3 firmware and the camera started a little more but the screen was all pixelated even the menus.  So i copied over a bunch of files from an older e4 i had, and the camera started up all the way.

Now the camera starts but none of the measurement crosshairs work and there is no thermal MSX option.  The camera also says its a flir e4 but i think its an e5.  This is probably from me copying a bunch of file from my old e4. 

I don't know what to do to fix the MSX and the measurment crosshairs.  If someone has some suggestions let me know.

[Fraser]

The loss of crosshairs and MSX indicates an invalid configuration so the camera uses a default factory configuration in order to operate for diagnostics. You need to look at the configuration files to see if the serial number matches your camera and the CRC has been correctly calculated. The identity of the Ex series cameras resides in the password protected eeprom so it is unlikely to be anything you have loaded that would change that. Saved images will contain your cameras true identity and you could look in the service menu as well.

Fraser

[adam3914]

The loss of crosshairs and MSX indicates an invalid configuration so the camera uses a default factory configuration in order to operate for diagnostics. You need to look at the configuration files to see if the serial number matches your camera and the CRC has been correctly calculated. The identity of the Ex series cameras resides in the password protected eeprom so it is unlikely to be anything you have loaded that would change that. Saved images will contain your cameras true identity and you could look in the service menu as well.

Fraser

Thank you, the only configuration file i know is the \FlashFS\system\appcore.d\config.d\conf.cfc is there more then one?

[thermal13579guy]

Is there any hacking difficulty difference comparing the first "counter-measured" version 1.21 to the latest 3.16?

[davegsm82]

I have an E5 at firmware version 1.22 which I believe is the countermeasured version, obviously I would like to do the resolution and maybe the menu hack.

Have seen the 'pspgamr' video describing the process but I can't seem to find working links for Flirtools or the command line tools to encrypt/decrypt the files.

Can someone help me out? I've searched hundreds of pages but this thread is absolutely bewildering.

EDIT - Found the command line tools, still stuck on Flirtools though. Do you just need the network driver tools or do you need the whole suite? I'm not looking to upgrade the firmware or anything.

EDIT (Final). Used the windows based tool on page 324, that worked ok and the camera runs with all the correct resolution and menu hack etc. It occasionally freezes, where the live image is still displayed but no menu can be displayed and the onscreen information doesn't update. You have to hold the power button until it reboots (or pull the battery). This seems to happen more often when using anything to the right of 'Auto Hot Spot' in the measurement menu. I've also noticed my camera has symbols on screen for Wifi and SD card, obviously these don't exist on the motherboard, could it be something to do with that?

To answer my previous question, I downloaded the driver pack but it seems to need the FLIR tools suite to actually create the network connection when you enable RNIS mode. When you plug the camera in when switched to this mode, the FLIR suite pops up a message near the system tray saying something like 'connecting to 192.168.0.2', but in order to get Filezilla to connect I had to forcefully close the suite from Task manager.