Flir E4 Thermal imaging camera teardown

[mikeselectricstuff]

Yep - just tested and it works. Just trying again from a clean boot with no pre-existing hack file

..and of course you should be able to use the same method to install a custom boot screen

[Wann]

YAY!

Yep - just tested and it works. Just trying again from a clean boot with no pre-existing hack file

[Wann]

Yep - just tested and it works. Just trying again from a clean boot with no pre-existing hack file

..and of course you should be able to use the same method to install a custom boot screen

Confirmed 

Ahhh. The resolution 

Now everbody be quiet as a mouse. Maybe FLIR will not find out about this. Maybe we should delete the last hour of posts? 

[mrflibble]

Yep - just tested and it works. Just trying again from a clean boot with no pre-existing hack file

Neat!  Now there really is nothing left to do for when I get my E4.  Well, except set up a toolchain and make some small apps. Or did maybe someone beat me to that as well? That would be awesome, because I'd love to get some details on how to set up the toolchain for this device. XD

Edit: forgot to ask, how much space is left on the flash device?

[mikeselectricstuff]

Only needs the camera.cmd in the zip

addfile flashfs/system/appcore.d/config.d/e8.cfg

[Wann]

Only needs the camera.cmd in the zip

addfile flashfs/system/appcore.d/config.d/e8.cfg

That is just too easy...

So when FLIR is uploading new firmware, we should basically be keeping our fingers off?
Or there's no way they can block this? 

[Wann]

Edit: forgot to ask, how much space is left on the flash device?

173 MB... 

[tnt]

So when FLIR is uploading new firmware, we should basically be keeping our fingers off?
Or there's no way they can block this? 

There is _plenty_ of ways they could block this ... too many to enumerate and I wouldn't want to give them ideas ...

[mikeselectricstuff]

Updated 3rd Jan - enabled zoom in .cfg for Taucher's Beta3 menu hack zoom function.


OK, so this is it.....
Seems to not be bothered about 7zip - I just used Windows "send to compressed folder"

Open E8.cfg in a PC text editor (not anything that will mangle linefeeds etc.!)

At the end of the file, replace xxxxxxxx with the 8-digit serial number of your camera

Save the file (Make sure there is exactly one CRLF at the end of the file)

At a PC command prompt, run

  CRC01 E8.cfg  (on the edited file)

This will display a line in the form
# CRC01 xxxxxxxx

Add this line to the end of the E8.cfg file, so it now looks like :

  # ID xxxxxxxx
  # CRC01 yyyyyyyy

where xxxxxxxx is your serial number and yyyyyyyy is the generated CRC
(should be exactly one CRLF after the CRC)
"CRC" is case sensitive - must be upper case. "01" is zero one

Save the file as flashfs\system\appcore.d\config.d\e8.cfg

Create a zip file containing the flashfs folder tree and camera.cmd
Rename the file from .zip to .fif


Install FLIR tools
Go to the install folder\bin
Turn camera on and plug USB in
Run FLIRInstallNet
Browse to your .fif file

Click Run FIF

Unplug USB, remove battery and replace

Enjoy!


To remove hack :
Run FLIRInstallNet, choose the "Remove_hack" .fif file


USB RNDIS MODE
Do not mess with if you don't know what you're doing!
You can easily brick your camera with careless console commands
If you don't know why you may want to use RNDIS, YOU DON'T!

RNDIS allows FTP and Telnet access, and access to service mode via web interface

web/ftp/telnet 192.168.0.2 login flir, pw 3vlig

To set USB RNDIS mode temporarily - until next hard restart
Run FLIRInstallNet, run the "Set_RNDIS_Temporary" .fif file
You will get a timeout error as it dumps the USB connection.

.fif Scripts are also included to set RNDIS permanently, and also remove permanent RNDIS
These add/remove the appcore.d\factory.d\zrndis.rsc file

When RNDIS is active, USB Mass sotrage and video mode are NOT available.
Access to files is still possible via FTP or the the Flir T3Mon virtual drive util that comes with the RNDIS device drivers

Note FlirInstallNet WILL work over RNDIS.

[mrflibble]

Only needs the camera.cmd in the zip

addfile flashfs/system/appcore.d/config.d/e8.cfg

LOOOOOOL! Seriously? That is just too easy.  Almost too easy. 

Edit: forgot to ask, how much space is left on the flash device?

173 MB... 

From my notes I have:

Code: [Select]


FLASH:
Toshiba AX1682
TAIWAN 13159AE 3
TC58NVG1S3ETA00

SLC NAND FLASH, 256 MBytes
Used 83/256 Mb, that's pretty low usage. Which is a good thing. Plenty room for some extra experimentation. Not strange now that I think about it, since that flash will also have to store all the images. Right? I recall Mike mentioning only 1 flash chippie, and two seperate LPDDR's (fpga + cpu).

There is _plenty_ of ways they could block this ... too many to enumerate and I wouldn't want to give them ideas ...

Yup. And I almost hope they'll try some. Preferably one of the predictable ones, because that way the solution has already been done. History, repeat.

[Wann]

There is _plenty_ of ways they could block this ... too many to enumerate and I wouldn't want to give them ideas ...

I tried running this in a terminal

Code: [Select]

rm -rf https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardownDidn't work.




Ah just kidding 

[tnt]

But I'd be more interested to find out how that .exe gets a shell in the first place and if we can make a software that does it.

[Wann]

..and of course you should be able to use the same method to install a custom boot screen

My new boot screen:


The seat keeps the heat from my behind. 

[mikeselectricstuff]

But I'd be more interested to find out how that .exe gets a shell in the first place and if we can make a software that does it.

Yeah, because it's soooo hard now.. - I suppose it would be nice to avoid needing the FLIR software. Nice of them to include all the tools you need ready in the box though!

If you could get the USB comms working standalone, you could in principle do something that reads out the serial no., merges and CRC's the file and copies in a single operation.

[mikeselectricstuff]

I wonder if a similar method would work on the i series - not sure if files are in the same place

[ixfd64]

A while ago, there was talk of a hidden menu that could be activated by a certain sequence of key presses. Has anyone found it yet?

[tnt]

Yeah, because it's soooo hard now.. - I suppose it would be nice to avoid needing the FLIR software. Nice of them to include all the tools you need ready in the box though!

Well not really for the hack itself, just to be able to play and experiment with the OS. I don't want to have to use a FIF to switch it to RNDIS (then switch it back) each time I want a console.

[mikeselectricstuff]

I'm fairly sure you can do it by putting the rndis.rsc file in \flashfs\system\appcore.d\factory.d
This file is in one of the early hack zips.

with rndis the only thing you can't do is webcam mode - you can pull your saved images via the Flir toolbar thing, or FTP

[mikeselectricstuff]

Mike (and anyone else with an E4):

How useful would you estimate this particular camera is for taking images of PCBs, in enough detail to identify which components are getting warm (with or without the benefit of your recent work)?

Yes -
See pics on this post

The only issue at the moment is adjusting the lens for close-up focus -the lens can be adjusted without opening as it's only locked by the friction of the surrounding rubber, but it's a bit hard to grab hold of. 
 I am working on a tool to do this, as well as looking at using cheap laser cutter lenses

Looking at the moulding on the lens surround could you make a tool out of polymorph? Just soften it and push it against the lens surround.

Maybe - problem is it needs to be rigid enough to push against the outer ring, but hollow enough to not block too much field of view - currently looking at a PCB ring with pins.

Just did a quick test impression with polymorph and seems to be pretty good - just need to figure out what shape the rest needs to be to a useful tool that can be used 'blind' while looking at the screen

[Wann]

I'm fairly sure you can do it by putting the rndis.rsc file in \flashfs\system\appcore.d\factory.d
This file is in one of the early hack zips.

with rndis the only thing you can't do is webcam mode - you can pull your saved images via the Flir toolbar thing, or FTP

There is a

Code: [Select]

zlast_RNDIS.rsc in the firmware file for the FLIR iX series firmware. Could you just rename that file, or is the real RNDIS.rsc different?

[mikeselectricstuff]

I'm fairly sure you can do it by putting the rndis.rsc file in \flashfs\system\appcore.d\factory.d
This file is in one of the early hack zips.

with rndis the only thing you can't do is webcam mode - you can pull your saved images via the Flir toolbar thing, or FTP

There is a

Code: [Select]

zlast_RNDIS.rsc in the firmware file for the FLIR iX series firmware. Could you just rename that file, or is the real RNDIS.rsc different?

Attatched are .rsc files for normal and rndis.

I'm not sure what happens if you have both - my best guess is they are read alphabetically, so to do rndis without touching the existing usb.rsc you may need to rename it to something later alphabetically.

(This may explain the  zlast name above)

The files are CR32'd, so can't just be edited without re-CRCing (method a few pages earlier here)   
I did try making one that did all 3 protocols but it went a bit nuts..


BTW a reminder that the first thing you should probably to if playing is run RNDIS and use filezilla to ftp off a backup copy of the whole \flashfs structure, as this is all the data specific to your camera.

[Wann]

Attatched are .rsc files for normal and rndis.

I'm not sure what happens if you have both - my best guess is they are read alphabetically, so to do rndis without touching the existing usb.rsc you may need to rename it to something later alphabetically.
The files are CR32'd, so can't just be edited without re-CRCing (method a few pages earlier here)   
I did try making one that did all 3 protocols but it went a bit nuts..

BTW a reminder that the first thing you should probably to if playing is run RNDIS and use filezilla to ftp off a backup copy of the whole \flashfs structure, as this is all the data specific to your camera.

So the zlast_RNDIS.rsc from the iX firmware file:

Code: [Select]

#
# USB mode MSD
#
.system entry
.system.usbmode text "RNDIS"
# CRC32 d51f0c78

and the rndis.rsc you zipped:

Code: [Select]

#
# Generated at 2000-01-08 21:43:17
# ID
#
.system entry
.system.usbmode text "UVC_MSD"
# CRC32 c37005c3

Hmm... That's the same as the usb.rsc you zipped...?

[mikeselectricstuff]

Oops - just updated zip file in above post with correct version

#
# USB mode MSD
#
.system entry
.system.usbmode text "RNDIS"
# CRC32 d51f0c78

[Wann]

(This may explain the  zlast name above)

Ahh. That makes sense.
So does the CRC checks the filename, or is removing "zlast_" via camera.cmd a possibility 

I've never worked with CRC before

[Wann]

So does the CRC checks the filename, or is removing "zlast_" via camera.cmd a possibility 

Nooooo. It's the same CRC32 value for both