Flir E4 Thermal imaging camera teardown

[madshaman]

Use vmware player, its free.

Obvious option if you don't already have a workstation license.  Point is, unix on a windows box with access to hardware resources is useful.

[IanB]

telnet client IS there - it is just not installed by default... http://elmajdal.net/Win7/Enabling_Telnet_Client_in_Windows_7.aspx

Cool. Thanks for that.

[Taucher]

Use vmware player, its free.

Hate to reduce the S/N ratio in the thread but...
Thanks Taucher for all the WinCE hacking!
Appreciate everything you can unlock in the FW!
Hopefully the T600 series FW holds some secrets yet

@VMs:
I found Oracle Virtualbox (also completely free) beeing my VM of choice - I can run the same VMs from Windows and from Linux, it doesn't cost me anything, has really nice installers and support, headless mode where I can let a server run VMs and just use network/RDP...

If one then needs a quick Linux console, then a Knoppix live DVD image will do just as good as an Ubuntu installation


@T600: I did a third look into the firmware and inside UI.d found some TML folder with %TMS files ...  the only thing readable seems to be a TMS file header - the rest is either encrypted or compressed (or both) as it's 100% "random garbage" but uicore (user interface core) tries to load it... so this will cause some headache (that's crying for IDA and way too much time) - but anyway .. probably not worth spending the time there

I'm pretty confident that the T600 camera has already all functions required for it's everyday use - at best it would be another hidden menu with some unimportant settings.

I hoped that the Ex models share some roots with the higher end models - where one can use condensation, insulation detection, time-lapse etc. by default (that would save fiddling-time).

[amyk]

I count approximately 200 dead pixels on Mike's camera which means approximately 99.74% of them are OK. But if you apply the 99.9% criteria to downsampled 80x60 and only count a dead pixel as e.g. more than half of any 4x4 "subpixel" dead, then a sensor that would be unusable for 320x240 may be perfectly fine in the E4.

I doubt it's just dust, as it was mentioned earlier that the sensor is heated so any particles on the sensor will have the same temperature and emit their own IR, not be at 40 below. Those appear to be truly dead pixels, but to be sure you could look at the internal dead pixel map.

[mikeselectricstuff]

Any recommendations for a Telnet client ? ....PuTTY ?

I have Win 7 X32 and X64 versions running on desktops. I also have XP on a laptop if easier.

Windows (at least up to XP) has a command-line telnet built in - just do start->run Telnet

[mikeselectricstuff]

MIKE

Just about to go to bed and suddenly thought ....DUST !

This may be totally wrong, but did you clean the micro-bolometer very carefully before reassembly ? I ask because I have had issues with black dots on CCTV cameras that turned out to be dust and dirt on the CCD faceplate casting a shadow on the pixel below.

If the bad pixel map is dynamic (a big IF as unknown at this time) then could it be that you have contamination of the micro-bolometer face plate or rear of the lens ?

There is some dust, but this is always bigger than one pixel - the Jpeg compression expands single pixels but you can clearly see the difference onscreen

[Pinkus]

Any recommendations for a Telnet client ? ....PuTTY ?

I have Win 7 X32 and X64 versions running on desktops. I also have XP on a laptop if easier.

Windows (at least up to XP) has a command-line telnet built in - just do start->run Telnet

At least in Win7 you need to activate it: enter programs and functions through START - control panel and then go to "activate windows functions". There activate "Telnet Client".
Remark: as I do not have an English Windows on my computer, the above mentioned menu items might be called slightly different on an English Windows system.

[mrflibble]

Any recommendations for a Telnet client ? ....PuTTY ?

I have Win 7 X32 and X64 versions running on desktops. I also have XP on a laptop if easier.

Windows (at least up to XP) has a command-line telnet built in - just do start->run Telnet

At least in Win7 you need to activate it: enter programs and functions through START - control panel and then go to "activate windows functions". There activate "Telnet Client".

At least putty is a telnet client that doesn't suck. And while we're at it, winscp in ftp mode is pretty handy for copying all your favorite files to/from your E4.

Virtualbox is indeed damn handy. Probably right up to the point where Oracle thinks it is just too useful, and decides to drop it. At any rate, windoze 7 in a VM on a linux host ==> flir tools etc work fine. RNDIS also works, but is a bit finnicky. Then again, RNDIS is a bit finnicky on native win7 as well. The DHCP implementation on the Win CE side could have been better. Hell, the entire rndis could have been done without, but such is life.

Anyone gotten rndis working on linux or *bsd yet? I tried, but noticed they just had to use some non-standard stuff. As in, I get RNDIS going but the WinCE side is not responding to dhcp requests. I think the flir driver does a secret handshake before the RNDIS setup, but ths requires some investigation.For now I dropped it, but maybe someone else had more success? If not, next up is check if there are some recent kernel patches with more rndis workarounds. Or maybe the *bsd implementation of rndis will have some useful workarounds...

That, and has anyone compiled their own binary yet for the E4?

Edit: forgot to mention re: rndis ... I am pretty sure it is a usb driver issue, because I can see the outgoing URBs (from host to E4) related to DHCP, but the E4 just doesn't respond. Which either means it's the wrong kind of request in the E4's book, or it's not in the right state yet. Which is kinda curious, because it /does/ setup properly up to that stage ... getting the proper MAC and all that. Mmmh, just thought of something. Maybe I can tweak the WinCE side so next time an rndis link is setup it will do static ip + static arp.

[Fraser]

UK SUPPLIER RECOMMENDATION

UPDATE @ 26 November. I have spoken with David today. They have stock at the moment. Please contact David direct for more information.


I have just spoken to David Atkins at PASS, who are supplying my E4. I was just checking on the latest delivery of these cameras and have been advised that 30 are due in today or tomorrow  Good news for all those waiting. PASS appear to have a very well stocked and reliable supply chain.

I was also advised that if members of the EEVBlog wish to contact David directly, he is a Level 1 Thermographer and will be happy to discuss providing the same discount as provided to me on my E4 purchase. Speak with David if you have any questions. His direct telephone number is : 01642 626142 

PASS have dealt with me in a very efficient and professional manner so if you are in the UK and thinking of buying an E4 ,I can certainly recommend them.

From PASS's point of view this increase in sales does them no harm and they are keen to help anyone who wishes to become the proud owner of an E4 without long delivery times !

I do not work for PASS or have any association with them, I am just a very content customer.
I am providing David's Details here as he is the best point of contact if you wish to discuss an E4 purchase and any discounts that he can offer you as an EEVBlog member   Just tell him you are a member of EEVBlog and can you have the same discount as Fraser.

Contact details for PASS:

-----------------------
Fraser

Should you require any more information, please do not hesitate to contact me. Tel: 01642 626142 (Direct)

Many thanks

David Atkins – Senior Account Manager
Certified Level 1 Infrared Thermographer

 
Test Equipment & Thermal Camera Sales
Tel: 01642 626142 (Direct Line)
Fax: 0870 143 1869
Mobile: 07792 742265

Email: dave@tester.co.uk

Please take a second to see what other services PASS can offer and remember we aim to beat any like for like quote:

www.pass.co.uk

Pass Ltd, 1 Alberto Street, Stockton-on-Tees TS18 2BQ
Registered Company in England and Wales - Reg No 4457106
VAT Registration Number 779714081

----------------------------
 
I hope this information is useful. When companies wish to offer special rates to EEVBlog members I believe in supporting them.

Note: PASS are an authorised Distributor for FLIR products and may be found on the FLIR official distributor list under their full name of : Portable Appliance Safety Services (PASS) Ltd.  here:

http://projects.flircs.com/distributors/?app=Building

Fraser

[Calimero]

Hello to all.

I have one question. I have chance buying FLiR E5 and when I readed this forum  - one question need to be answered. Is it E5 better in some way? Better sensitivity / thermal / or better chip or processor then E4?

Or better is go with E4 and make " E8 upgrade " ?

All sellers says - that each camera is different inside / different lenses, better thermal sensitivity, better quaiity at all / I don´t believe in this words but want ask you, my friends.

[PA0PBZ]

They are all different inside.... but only if you look at the software 

(all evidence we have at the moment^* says that the hardware is the same)


^{* disclaimer}

[sipo75]

Hello to all.

I have one question. I have chance buying FLiR E5 and when I readed this forum  - one question need to be answered. Is it E5 better in some way? Better sensitivity / thermal / or better chip or processor then E4?

Or better is go with E4 and make " E8 upgrade " ?

All sellers says - that each camera is different inside / different lenses, better thermal sensitivity, better quaiity at all / I don´t believe in this words but want ask you, my friends.

It seems they are basically all an identical build. Some components like the sensor could be from a better selection from a batch (fewer dead pixels to satisfy the specification of higher resolution models). Most of the features seem to be software enabled though.

[mrflibble]

I have one question. I have chance buying FLiR E5 and when I readed this forum  - one question need to be answered. Is it E5 better in some way? Better sensitivity / thermal / or better chip or processor then E4?

As far as we can tell it's the same hardware. The jury is still out regarding binning of the sensor. With our current small amount of samples it could go either way. It might be that the more expensive models get a better binned sensor, and the E4 gets whatever is left over. Not sure.  If the E4 gets the lower bins then it would depend a bit on the luck of the draw. But as shown you can get a nicely working 320x240 TIC with ~ 200 dead pixels just fine.

But since we need more data, I vote you and a lot of other people get an E5 / E8.   

[mikeselectricstuff]

Hmmmm, I just received a resonse from FLIR regarding the possibility of buying a spare lens and the availability of a tripod mount adapter....

Here it is in all its glory.......

----------
Dear Mr. xxxxxxxxxx,
Please revert back to your supplying Distributor, they will be able to assist you.
PASS 01642 631685

Kind Regards,
-----------

Not quite what I expected.

Thy could at least have given you a part number...

[dhenryp]

I was on the verge of buying the E4 even before this hack was announced because I thought the 80X60 resolution was OK for my uses (checking for heating system leaks and general DIY audio amplifier thermal testing). I'm going to order one this afternoon even if I just use it in 80X60 mode.
My question is; what is the likelyhood of simplified hacking instructions getting documented that would get me the 320X240 resolution and would have very low probability of bricking the unit? I've read the instructions in previous posts but I have just about zero hacking experience (e.g. I've done very little at a PC command line and I've never used telnet). Please no flames but let me know if I shouldn't be trying this as my first real hack.

Thanks,
Denis

[toforgive]

Flir B335 converted to B425
Functions added: panorama, video recording, program mode, thermal fusion!

All credits goes to Mike! many many many many thanks! 

- in camera settings set usb mode to network disk
- ftp to /FlashFS/system/gui.d/config.d/ (user: flir pwd: 3vlig)
- edit gui.cfg and replace all "false" with "true"
- put the correct CRC in the file and overwrite it in the camera
- shut down camera, remove battery, restart

Greetings from Italy

 

[mikeselectricstuff]

I was on the verge of buying the E4 even before this hack was announced because I thought the 80X60 resolution was OK for my uses (checking for heating system leaks and general DIY audio amplifier thermal testing). I'm going to order one this afternoon even if I just use it in 80X60 mode.
My question is; what is the likelyhood of simplified hacking instructions getting documented that would get me the 320X240 resolution and would have very low probability of bricking the unit? I've read the instructions in previous posts but I have just about zero hacking experience (e.g. I've done very little at a PC command line and I've never used telnet). Please no flames but let me know if I shouldn't be trying this as my first real hack.

Thanks,
Denis

It really isn't that hard, and with the standard hack the worst that will happen if you get it wrong is it will stay in E4 mode as it doesn't disturb any of the existing files. Only the menu hacks are a bit more invasive so stay away from those if you're nervous.

[Pinkus]

Anything what I can do to copy a 1.18.8 firmware (hackable) from one E4 and write it to another with 1.18.7?
By just copying all directories files with Filezilla, many files are skipped (probably being used by Windows) and I am afraid of just writing those back to another camera.

[mikeselectricstuff]

Anything what I can do to copy a 1.18.8 firmware (hackable) from one E4 and write it to another with 1.18.7?
By just copying all directories files with Filezilla, many files are skipped (probably being used by Windows) and I am afraid of just writing those back to another camera.

I wouldn't risk it - I don't think anyone has noticed any issues with earlier FW so best to leave as-is.

[mikeselectricstuff]

Well we have now heard of a B series model being released from its 'chains'. I wonder how many other models will now be given the 'Mike' treatment and upgraded via just firmware switches ? 

I have an RS232 maintenance port on my PM series cameras just begging to be investigated 

Maybe after I have learnt a bit more about such 'hacking' processes.

I'd be surprised if the Ex0 series weren't very similar - all donations welcome (subject to export regs of course!)

[MrSquirrel]

I have just spoken to David Atkins at PASS

Placed an order with Pass first thing this morning but that was before i read Aurora's post, d'oh!

Was put through to their Thermography guy (that was David) and yes everything seemed well organised - will let you know how i get on.

I was seriously thinking of getting an E4 after Mike's review (the MSX feature looks superb) but this thread pushed me over the edge to commit.

[tealsuki]

Any recommendations for a Telnet client ?

Well, bugger. What is the world coming to?

Telnet is activatable through the "install optional features" menu in the add/remove programs page, iirc.

Edit: d'oh, should have read the next three pages before I commented.

[Petrlib]

They are all different inside.... but only if you look at the software 

(all evidence we have at the moment^* says that the hardware is the same)


^{* disclaimer}

I am in same situation. Already contacted Mike for little help / Thank you / Aurora and others. I think I know right now - how to do " hack " but still waiting for my camera. I ordered E5 10 days ago and my seller said - you must wait minimum 7 more days because too many people making orders. But this seller offers me E4 - in stock and for collection ready in 24 hours.  I am from Czech Republic.

Is really E5 much better than E4 ? What do you think MIKE, AURORA and other members? Is it worth it to buy E5 instead E4??

[bean_dip]

I am in same situation. Already contacted Mike for little help / Thank you / Aurora and others. I think I know right now - how to do " hack " but still waiting for my camera. I ordered E5 10 days ago and my seller said - you must wait minimum 7 more days because too many people making orders. But this seller offers me E4 - in stock and for collection ready in 24 hours.  I am from Czech Republic.

Is really E5 much better than E4 ? What do you think MIKE, AURORA and other members? Is it worth it to buy E5 instead E4??

By the specs, the E5 is probably a worthwhile improvement over the E4 if you don't plan on hacking it.  It offers 2.25 times the thermal pixel count for a 50% increase in price.  If you're going to hack it, they're all an E8 inside anyway so you'd be better served to save some money and get an E4.

The flip side to that is that you will have a ~$1,495 (US) camera that will do everything the ~$5,995 (US) camera will do and more with the instructions posted here in this thread.

So, you could either say that you overpaid by ~$500 (US) or that you will still save yourself ~$4,500 (US)...depends on whether you want to look at the bright side or not.

If it was me, I'd cancel the order for the E5, buy the E4 that's already in stock, and follow closely the instructions in this thread to unlock all the software goodies...

[Clint]

I have to sniggle when people say 'grey importers' I used to use that exact phrase to put people off buying the same product from cheaper sources when I worked in the industry................... we used to source from the cheapest places we could find and because we were a dealer we could rubber stamp it as UK sourced...............

Its a global environment we live in now.