Poll

Has the hackabiliy of the E4 made you buy one :  

Yes, I was already looking at the competition at a similar price, but the hack swung it to E4
238 (26.3%)
Yes, I'd not considered buying a TIC before, but 320x240 resolution at this price justifies it (as either tool or toy!)
425 (47%)
Yes, I was going to buy an E5/6/8 class of unit but will now get the E4
43 (4.8%)
No, but am looking out for a cheap i3 to hack
41 (4.5%)
Not yet, but probably will if now that a closed-box hack becomes is possible
158 (17.5%)

Total Members Voted: 780

Author Topic: Flir E4 Thermal imaging camera teardown  (Read 2633891 times)

0 Members and 3 Guests are viewing this topic.

Offline dmendesf

  • Contributor
  • Posts: 39
  • Country: br
Re: Flir E4 Thermal imaging camera teardown
« Reply #8375 on: December 28, 2017, 02:13:08 am »
Replying to myself....

I was using cfccfg.py instead of cfccgf_v2.py. Using V2 there´s no trash at the end of the decrypted file. BUT.. still no luck.

When I make changes to conf.cfc the image improves (less noise) but Thermal blending stops working and TSX vanishes from menu (screenshots below). Images captured with the edited conf.cfc aren´t recognized by Flir tools (it shows them but no additional information is given, like the thermal resolution). I´m using the  modified common_dll . I´m sending files by FTP in RNDIS mode. After each update I turn off the camera, take the battery, wait 5 seconds and put it back/turn on. Am I missing something?

I noticed that my configuration file is much shorter than the default hacking script wants. Maybe missing configuration lines? Can someone send me a decrypted conf.cfc for default firmware 2.3.0 so I can check what´s missing?
« Last Edit: December 28, 2017, 02:19:59 am by dmendesf »
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 3332
  • Country: ca
Re: Flir E4 Thermal imaging camera teardown
« Reply #8376 on: December 28, 2017, 02:51:03 am »
Your new config is not getting loaded for some reason, that is why you observing that result.

Try encrypting the original cfg file back with no changes, see if the camera works same way as with the original cfc. This is to test if your encryption works and if the modified common_dll works.

Try adding a proper CRC03.

Try leaving the camera with no battery overnight.

BTW make sure you only have one cfc file in the folder.
Facebook-free life and Rigol-free shack.
 

Offline dmendesf

  • Contributor
  • Posts: 39
  • Country: br
Re: Flir E4 Thermal imaging camera teardown
« Reply #8377 on: December 28, 2017, 02:54:12 am »
Thanks, will try all of this, but what´s a proper CRC03?
 

Offline dmode90

  • Contributor
  • Posts: 18
  • Country: ua
Re: Flir E4 Thermal imaging camera teardown
« Reply #8378 on: December 28, 2017, 03:07:30 am »
Does the sensitivity changing after e4 hack?
And how to check whether it has changed?
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 3332
  • Country: ca
Re: Flir E4 Thermal imaging camera teardown
« Reply #8379 on: December 28, 2017, 03:58:30 am »
but what´s a proper CRC03?

It is the value in the last row in your config file. There was an executable posted in this thread to calculate it, you will have to find it. However the properly patched common_dll eliminates the need for it and CRC03 can be left unchanged.
Facebook-free life and Rigol-free shack.
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 401
  • Country: by
    • My website
Re: Flir E4 Thermal imaging camera teardown
« Reply #8380 on: December 28, 2017, 04:17:04 am »
Does the sensitivity changing after e4 hack?
And how to check whether it has changed?

There is a setting in the config file called "targetNoise" - disable it(true to false) and set the target to 0.
It's an artificial noise generator used by FLIR to purposefully hinder the sensor's performance on lower end models - it's even enabled on the E60, just to a lesser degree!

The actual sensitivity of the sensor has been measured by other users to sometimes fall under 25mK(0.025C).
 
The following users thanked this post: dmode90

Offline dedelekid

  • Contributor
  • Posts: 9
  • Country: dz
Re: Flir E4 Thermal imaging camera teardown
« Reply #8381 on: December 29, 2017, 01:15:24 am »
just in case if my message was not read ..

Quote
Can someone post this files "T559504%24A.pdf" T559504$A.pdf , if they still had in his archives? thank you.
it will give me a bit of reading .........
 

Offline Fraser

  • Super Contributor
  • ***
  • Posts: 8318
  • Country: gb
Re: Flir E4 Thermal imaging camera teardown
« Reply #8382 on: December 29, 2017, 01:28:04 am »
I know what that document is, but others may not recognise it by the cryptic FLIR file title. From memory it is a document relating to the ''A" series cameras that detailed the Console commands.

Sadly I cannot find my copy of that document at the moment. Try asking again, but using its document name. You may get a better response.

Fraser
« Last Edit: December 29, 2017, 01:32:59 am by Fraser »
 

Offline dmendesf

  • Contributor
  • Posts: 39
  • Country: br
Re: Flir E4 Thermal imaging camera teardown
« Reply #8383 on: December 29, 2017, 02:12:30 am »

Did as following:

cfccfg_V2.py 1151d50200581c2b conf.cfc conf.cfg

cfccfg_V2.py 1151d50200581c2b conf.cfg conf2.cfc

uploaded conf2.cfc to camera. Didn´t work (of course I renamed it conf.cfc). Did a diff of the 2 files... there´s a bunch of differences at the end ( Think 128 bytes of conf.cfc turned into zeros in conf2.cfc).

Ok, so I had a great idea... let´s make a conf2.cfg from conf2.cfc and spot the differences! There were none  |O

Then I noticed that the cfg files are smaller then the cfc ones... so it´s not a classical encryption/decryption were 1 byte goes in and 1 byte goes out.

I think I probably made a mistake at the DLL edit. I´ll do it again. If it doesn´t work i´ll search for the CRC03.


Your new config is not getting loaded for some reason, that is why you observing that result.

Try encrypting the original cfg file back with no changes, see if the camera works same way as with the original cfc. This is to test if your encryption works and if the modified common_dll works.

Try adding a proper CRC03.

Try leaving the camera with no battery overnight.

BTW make sure you only have one cfc file in the folder.
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 3332
  • Country: ca
Re: Flir E4 Thermal imaging camera teardown
« Reply #8384 on: December 29, 2017, 02:34:47 am »
Did a diff of the 2 files... there´s a bunch of differences at the end ( Think 128 bytes of conf.cfc turned into zeros in conf2.cfc).

Ok, so I had a great idea... let´s make a conf2.cfg from conf2.cfc and spot the differences! There were none  |O

Then I noticed that the cfg files are smaller then the cfc ones... so it´s not a classical encryption/decryption were 1 byte goes in and 1 byte goes out.

This behaviour is expected. This is the way the python script works. This all looks OK.

Quote
I think I probably made a mistake at the DLL edit.

Yes your DLL was not done right or not transferred to the camera correctly. Download you current DLL from the camera and see if that was the one you uploaded before.
Facebook-free life and Rigol-free shack.
 

Offline dmendesf

  • Contributor
  • Posts: 39
  • Country: br
Re: Flir E4 Thermal imaging camera teardown
« Reply #8385 on: December 29, 2017, 02:42:44 am »
I did again the DLL edit and upload. Nothing changed. Then I found the CRC03 program, used it to update conf2.cfg. made a new conf.cfc from it and uploaded again. Still the same result. I´ll return with the old DLL now (as now I have a conf.cfc with good CRC03) and see what happens... i´m running out of options. I´d like to compare my files with other known to work ones.

EDIT: returned with old DLL, nothing changed. No clue about what to do now.



This behaviour is expected. This is the way the python script works. This all looks OK.

Quote
I think I probably made a mistake at the DLL edit.

Yes your DLL was not done right or not transferred to the camera correctly. Download you current DLL from the camera and see if that was the one you uploaded before.
« Last Edit: December 29, 2017, 02:54:43 am by dmendesf »
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 3332
  • Country: ca
Re: Flir E4 Thermal imaging camera teardown
« Reply #8386 on: December 29, 2017, 02:50:23 am »
How you upload the DLL ? Typically you need to run appstop stopapp in Telnet before you upload it.  Have you checked what you have on the camera is what you have uploaded ?
« Last Edit: December 29, 2017, 03:50:19 am by Bud »
Facebook-free life and Rigol-free shack.
 

Offline dmendesf

  • Contributor
  • Posts: 39
  • Country: br
Re: Flir E4 Thermal imaging camera teardown
« Reply #8387 on: December 29, 2017, 02:57:04 am »
This is new information to me. No, I didn´t check, just put it there. will look for the syntax of appstop and try this... Thanks again.  :-+

EDIT: search returned no hits for appstop. Are you sure this is the name of the command?

EDIT: found it, it´s stopapp :) Will try tomorrow. Found some other ideas to try.

How you upload the DLL ? Typically you need to run appstop in Telnet before you upload it.  Have you checked what you have on the camera is what you have uploaded ?
« Last Edit: December 29, 2017, 03:25:13 am by dmendesf »
 

Offline dmendesf

  • Contributor
  • Posts: 39
  • Country: br
Re: Flir E4 Thermal imaging camera teardown
« Reply #8388 on: December 30, 2017, 03:26:55 am »
EDIT : VICTORY!!!!  ;D ;D ;D ;D ;D ;D ;D

See attached image....

Read back common_dll and noticed that it wasn´t modified. Used stopapp, uploaded again, downloaded again.. now it changed. (file date also changed... it´s a good indication if the update really ocurred). Camera reboot... and now it works. Thanks for all that helped me thru it, especially Bud.

Now it´s time for menu hack  ;D
« Last Edit: December 30, 2017, 04:15:37 am by dmendesf »
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 3332
  • Country: ca
Re: Flir E4 Thermal imaging camera teardown
« Reply #8389 on: December 30, 2017, 04:28:08 am »
Yah baby, now we' talking!
 :-+
Facebook-free life and Rigol-free shack.
 

Offline dmendesf

  • Contributor
  • Posts: 39
  • Country: br
Re: Flir E4 Thermal imaging camera teardown
« Reply #8390 on: December 30, 2017, 04:43:18 am »
Started studying menuhack... Tried as described here:

http://fubar.gr/hacking-the-flir-e4/

Noticed that it patches conf.cfc at a fixed offset. Will this work with my conf.cfc with unusual size? I think that it´s not a good idea... Maybe I need to manually decrypt it, copy the relevant parts, encrypt again... what do you think?

EDIT: Tried it anyway, camera got screwed up like when common_dll wasn´t patched... Will restore to previous state...

RE-EDIT: Camera restored to resolution hack only.... will study how to apply menu hack manually... pointers are welcome :)
« Last Edit: December 30, 2017, 04:55:45 am by dmendesf »
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 3332
  • Country: ca
Re: Flir E4 Thermal imaging camera teardown
« Reply #8391 on: December 30, 2017, 06:41:39 am »
Search this thread backwards for the last post from user  janekivi which has 2.3.0 menu update package. Unarchive and manually copy the files to your camera. I am not a fan of automated scripts, they too often screw things up.
Facebook-free life and Rigol-free shack.
 

Offline dmendesf

  • Contributor
  • Posts: 39
  • Country: br
Re: Flir E4 Thermal imaging camera teardown
« Reply #8392 on: December 30, 2017, 03:26:21 pm »
Thank you again... found it:

https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg577970/#msg577970

Manually applied all patches and now I have plenty of new menu options :)


Search this thread backwards for the last post from user  janekivi which has 2.3.0 menu update package. Unarchive and manually copy the files to your camera. I am not a fan of automated scripts, they too often screw things up.
« Last Edit: December 30, 2017, 03:28:40 pm by dmendesf »
 

Offline Bud

  • Super Contributor
  • ***
  • Posts: 3332
  • Country: ca
Re: Flir E4 Thermal imaging camera teardown
« Reply #8393 on: December 30, 2017, 03:40:29 pm »
Enjoy!  :-+
Facebook-free life and Rigol-free shack.
 

Offline kulu22

  • Newbie
  • Posts: 1
  • Country: hu
Re: Flir E4 Thermal imaging camera teardown
« Reply #8394 on: January 07, 2018, 10:59:49 am »
Hi guys,
First of all, sorry for my english. This post is hardware related, and I hope it will help some members. I bought an E4 with broken (missing) USB and defected display from Ebay. As I know, the USB problem is common with these devices. Repairing this by Flir is pretty expensive (in my case ~ 50 + 50 EUR for shipping and ~ 250EUR for inspection + VAT, but the cost of inspection will be deducted from the final repair cost), comparable to price of a used unit. So I decided try to fix it by myself.
After disassembled the E4 (thanks to Mike's video), I saw that the edge of USB driver is broken and the pins of this chip are shorted by sloldering material. Not too good news.
In the first round I cleaned the damaged area and placed a new USB connector on PCB. Huh, it's a quite task. Unfortunately after this, the E4 still not communicated with the PC. After browsing some datasheets I found a Microchip device that has similar pinout like PCB pattern. I ordered it and replaced the broken one. And voila, everything works now. I can charge by USB and the device is visible from PC.
The chip type is USB3751A-2-A4-TR in a QFN16 case.
 
« Last Edit: January 08, 2018, 04:44:32 pm by kulu22 »
 
The following users thanked this post: edavid, stefbeer, -jeffB, Xenawise, Zs8192

Offline thedamner

  • Newbie
  • Posts: 1
  • Country: us
Re: Flir E4 Thermal imaging camera teardown
« Reply #8395 on: January 11, 2018, 05:50:29 pm »
I wanted to say thank you to all the work you guys have done to help open up these E4's.  I also wanted to post here of what finally worked for the E4 I recently purchased, since there is SOOOOO much information here to sort through.

My camera: PN: 63901-0101, Firmware: 1.21.0.  I was able to put it into RNDIS mode directly from the menu on the camera which helped.  I also initially was following the information here http://fubar.gr/hacking-the-flir-e4/, in hopes it would speed up the process, it didn't: http://fubar.gr/hacking-the-flir-e4/

I spent a great deal of time trying to figure out which firmware to use.  I'm still a bit shaky if there is a working firmware into 2.x that works for these older cameras; however I discovered that anything beyond my 1.21.0 was causing my crosshairs / center spot to vanish, as well as the MSX function  |O.  However, the resolution hack always worked perfectly, the menu hack using the provided python script failed with an assertion error in the script.

So, after volleying around trying every solution just to even get back my MSX/Crosshairs this process worked perfectly:

Revert back to 1.21.0 and reset factory settings.
Put the phone into RNDIS mode via the menu.
Download the CFC Generator from Stefbeer: https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg411505/#msg411505
Use the Template file provided, turned off the noise in the CFC file, copy the resulting CFC file to the camera.

Download the Beta 3 Menu Hack: https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg326024/#msg326024
Very carefully using FileZilla copy the files to the camera and reboot.

Everything came back perfectly.  Menu hacks and resolution, with the noise down the image is quite striking in comparison to the non hacked version.

More about my caveat with menu hack, and to re-iterate being careful.  Somehow I initially fubarred the upload (seeing files error out threw me off) and tried to restore the files from my backup thinking I'd messed up; I temporarily bricked the camera.  The Flir logo would come up, but after that just black screen.  Flirtools didn't see the camera at all, I didn't know if it was in RNDIS mode or not.  I couldn't communicate with it in FileZilla or get it beyond a black screen.

To fix the bricked camera, at least in my instance I discovered the Telnet connection was still working and FLIRInstallNet.exe could still apparently see the camera.  So, I just loaded up one of the many firmware .fif files I had lying around and ran it.  It updated the firmware on the camera just as it would have if you updated the firmware from within Flirtools.  However, the behavior during the update was totally different.  There was no display on the camera of it copying files or anything but when it was finished FLIRInstallNet asked to reboot the camera; viola it came back to life again. 

In the end I settled on the above process and staying with 1.21.0, but I thought after digging through the forums and toughing out the many update attempts it was worth writing a post in the event anyone else has the same situation, an older E4 and sooooo many posts to search through.

I'd be interested if others already know of other firmware what would officially work on the older camera, if there was a compelling reason (new, better,  menu hack options) but for now the camera is stable, works great and the with the menu hacks I have lots more functionality!

Thank you all again for all this incredible help and please ignore this if you are already an expert here, I'm just writing this for someone in my same situation.
 
The following users thanked this post: stefbeer, -jeffB

Offline haef

  • Contributor
  • Posts: 5
  • Country: us
Re: Flir E4 Thermal imaging camera teardown
« Reply #8396 on: January 16, 2018, 04:23:03 am »
My apologies if the answer to this is buried in all this excellent info:

Before I recently became aware of the E30 hack, I was doing a firmware update using FLIR's utility.

The problem is that after the update, the camera now will not complete the startup process.  The progress bar gets to the end and then... sits there.  Camera shows an image, but does nothing else useful.

The only thing I can get it to do is display the version number under the progress bar "FLIR E30 2.23.14*"  Not sure what the asterisk is about.

If anyone has seen this problem and can suggest a cure, I'd sure appreciate hearing about it.  I want to do the hack!
Otherwise, it is going to have to go back to FLIR for service.  And I'm afraid they'll do something that will make it un-hackable in the process of resurrecting it.

Ironically, it was searching around for an answer to this problem that led me to the hacking possibilities.  This is mean.   :(
 

Offline Fraser

  • Super Contributor
  • ***
  • Posts: 8318
  • Country: gb
Re: Flir E4 Thermal imaging camera teardown
« Reply #8397 on: January 16, 2018, 06:15:41 am »
Have you tried repeating the firmware upload starting from scratch with a different SDCard and a fresh copy of 2.23 ?  You did do an SDCard update didn't you and not something via USB ?

Fraser
 

Offline haef

  • Contributor
  • Posts: 5
  • Country: us
Re: Flir E4 Thermal imaging camera teardown
« Reply #8398 on: January 16, 2018, 03:43:05 pm »
This problem happened a few months ago, and I put it on the shelf due to lack of time.  So going from memory here... 

4 years ago I performed a an update.  I believe the process is what you are alluding to: Download firmware.  Put the firmware on a card, put in camera, use the camera menus to execute the update.  No problem.

This time I used a usb cable hooked to a PC and the Flir tools to perform the update.  I'm fairly sure there wasn't an option to do it the former way, and I believe it was PC Tools job to go retrieve the firmware.  That's how it broke.  There wasn't and still does not appear to be a way to download the firmware.  I need to retry it, but I think the PC Tools cannot find the camera now.

Thoughts?
 

Offline haef

  • Contributor
  • Posts: 5
  • Country: us
Re: Flir E4 Thermal imaging camera teardown
« Reply #8399 on: January 20, 2018, 12:47:00 am »
Has anyone here actually bricked their Flir?  Was recovery possible?  I'm not finding much.

FWIW, I see Flir has a new Exx series update:  2.27.15  dated Jan 17, 2018
http://80.77.70.144/SwDownload/app/RssSWDownload.aspx?ID=127

Wonder if that one is hack-proof?
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf