Flir E4 Thermal imaging camera teardown

[mucek]

You can up the resolution on your e40 just like the e4.

How can I do that? I only found, that this is possible for Ex and Ix series, I expected, that Exx have different sensors. Am I mistaken? (if you did it - can you describe it?)
Also MSX seems to be very good feature, which improves image readability in a great way.

I know E40 has several advantages and is also built better (IMHO), but still - I need camera for its functionality, not for being nice on a shelf ...

Regards,
Gregor

[emptech]

To change the resolution is even easier than the latest e4 models.  If all you want to do is up the resolution,
all you need to do is take your conf.cfg file, make the changes and create a new CRC calculation.  I started
with the files from "funzt" and went from there.  You can essentially make your e40 into an e60, that's going
from a $4K camera to an $8K camera for a few minutes of work.  I know the search engine on this site isn't
very good, but if you look hard enough, you will fine the files uploaded from funzt.  You can also experiment
with the settings.  Just make sure that everything is backed up before you make any changes.  Unless you
have a late model e40, you will not have the MSX feature, but I don't know how important that is.

So many of us thought we bricked our cameras, including me, but for the most part, we didn't.  I don't know
what the actual count is for those who actually killed their cameras, I'm guessing, one or two.

Always leave your original files on your camera, all changes are added to NEW files which are downloaded
to the cameras, in case you really screw up, then the original files are still there.

Hope this helps -  Jim

Mike - don't you ever get any sleep?

[mucek]

HUH! That's an information!!!
Sure I will take a look at this! Searching ...

Regards,
Gregor

p.s. Which version of FW do you have on E40? I have the latest version and I assume, an additional CRC will have to be implemented (just like with newer firmwares on E4x).

[emptech]

My e40 is a couple years old now, bought it new.  I flashed the firmware one time since I've had it,
currently it is 2.23.14.  I don't know if there is anything later for my serial number range.  The CRC01
works on mine, nothing in the files is encrypted, everything clear text, use notepad or some simple
text editor to work with.

Funny story, after I bought the camera, I went to some seminars and heard the cam had zoom.  I
couldn't find it on the menu.  I asked the dealer, jokingly, he said, just get up closer.  Something
wasn't right here.  Later at another seminar, I asked the instructor about the zoom, he asked if I
downloaded the latest firmware.  I did (the version above) and bingo, I then got zoom, x2 woopie.

Of course, now I have x1, x2, x4, and x8 zoom.

I don't know if the current e40 cams use this version, I don't think FLIR is very proactive in closing
up the back doors in their camera, so I'll bet the latest e40 cams have no problem being upgraded.

Jim

[mucek]

Found this ... Bascally speaking, I should:
- Connect E40 to computer to get access to the filesystem (didn't get that part completely - is there any special driver required for this operation (access to filesystem) )
- Locate files that are in the corresponding folders as the ones in the attached E60 map
- Check for # ID 490xxxxx in one of the files on the camera and apply this ID to all files
- Calculate CRC of each (new) file with V1 tool (https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg321956/#msg321956) and add this information as a last line (+ one CRLF)
- Make backup of all original files (probably renaming them is just fine and they can stay, where they are?)
- Move "new" files to the location of the old files

Is that so?

Regards,
Gregor

p.s. Things will get more complicated, if new Flir's E40 firmware also has "new" protection methods ... However, then this can be done the same way as described here (https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg403480/#msg403480)?

[pomonabill221]

Found this ... Bascally speaking, I should:
- Connect E40 to computer to get access to the filesystem (didn't get that part completely - is there any special driver required for this operation (access to filesystem) )
- Locate files that are in the corresponding folders as the ones in the attached E60 map
- Check for # ID 490xxxxx in one of the files on the camera and apply this ID to all files
- Calculate CRC of each (new) file with V1 tool (https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg321956/#msg321956) and add this information as a last line (+ one CRLF)
- Make backup of all original files (probably renaming them is just fine and they can stay, where they are?)
- Move "new" files to the location of the old files

Is that so?

Regards,
Gregor

p.s. Things will get more complicated, if new Flir's E40 firmware also has "new" protection methods ... However, then this can be done the same way as described here (https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg403480/#msg403480)?

I would do step 4 (backup all original files) FIRST before doing ANYTHING!  That way, if access to the camera is somehow trashed, you have the original files and folder structure.

[mucek]

True! Will do that

[strantor]

I've spent a couple hours in this thread and elsewhere, reading about this hack. I haven't seen the answer to my question in bold black and white so I'll just ask it: Is there any good reason for me to be looking for a 1.19.X? I watched the 1.21 & 1.22 video (thanks for that) and it seemed simple enough, but there's still something nagging in the back of my head; something I read (can't remember exactly what/where I read) that has me convinced there's a higher likelihood of bricking a 1.22 or 1.21 and the 1.19 is a safer bet. I have found someone selling (or claiming to sell) a 1.19 but it will take a couple of weeks to get it and honestly it feels fishy. I'd much rather make that 2 day Amazon prime impulse purchase but I feel like that could be even more of a crap shoot.
Please advise

Thank you.

[mucek]

Well, obviously writing of a problem on EEV helps way more than working on it directly
I already am on camera through filezilla ... Just backing up ...

[mucek]

Camera (E40bx, ver. 490xxxxx) still works and works with 320x240 resolution! Should work with all Exx cameras I guess.

However, I have 2 questions:
- I can't get thermal fusion to work - any idea here?
- I can't change logo (FlashFS/system/bootlogo.bmp) - I created same size image and replace it, but no difference. Not a big deal actually, but would be nice.


Here are steps for dummies (like me! ):
- Download tools from https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg321956/#msg321956
1. Download E60 files from my previous post (E60 goodies)
2. Modify files with proper serial number and calculated CRC. Mind all described in CRC01 tool text file!
3. Download clonezilla
4. Turn on camera, connect it to wlan. Check its IP in WLAN settings
5. Connect to camera with clonezilla. Use IP, seen on camera WLAN settings, username "flir", password "3vlig"
6. Backup FlashFS folder - there are all files, that will be altered.
7. Replace files on camera with ones, that you created. I suggest only renaming original files with .old extension instead of rewrite/delete. This way original files are backuped on camera as well.
8. Shut down camera, remove battery, wait a bit and then turn camera on (offcourse insert battery first ) Voila!

EDITED
Due to unknown reason, with my camera (and latest Flir firmware - 2.23.14) this change only works in a following way:
- Do everything described above (DO RENAME OLD FILES!!!)
- Cold start camera (off, battery out, on)
- Connect to it back, and rename "new" files with .new
- Rename "old" files back to original name
- Cold start camera (off, battery out, on)
This was it works! (also Thermal fusion!)

I would like to thank all of you guys for help you provided!

Regards,
Gregor

[mucek]

Checked ... It worked! Difference is nicely visible, when shooting (pretty) same image ...

Regards,
Gregor

[strantor]

I haven't read all 4800+ posts, but for those of who have, what is the success rate for hacking the 1.21 & 1.22? Anybody permanently bricked one yet?

[mucek]

As there is a program developed, which does everything almost automatically (also backup) I guess there shouldn't be too problematic. Still, no idea about actual numbers, but I guess if anyone would brick it I am sure he would search for advice here

Another question about E40 (hmm, shall I say E60?! ):
- How to make FLIR logo on image transparent as it is done in menu hack for E4 (is it possible to simply browse for it and replace it with transparent PNG? Guess not )
- Any idea about startup image changing? I did replace the original image with another one (same size, same type (BMP), but loaded is still the original one.

Regards,
Gregor

[Rainer]

One known TIC was bricked in "research". But this was a failed downgrade from 1.21.0 to 1.18.x and not while changing the crypted config.

The bootloader of the bricked TIC was still running. So it should not be impossible to unbrick this device.

It was happen in this thread at about page 270

[tomas123]

Another question about E40 (hmm, shall I say E60?! ):
- How to make FLIR logo on image transparent as it is done in menu hack for E4 (is it possible to simply browse for it and replace it with transparent PNG? Guess not )

go to telnet and type

Code: [Select]

rset .ui.userSettings.overlayLogo false

[mikeselectricstuff]

It was happen in this thread at about page 270

Page numbers are not meaningful, as users can configure the number of posts per page - for me this thread isn't up to 100 pages yet.

[tomas123]

Camera (E40bx, ver. 490xxxxx) still works and works with 320x240 resolution! Should work with all Exx cameras I guess.

However, I have 2 questions:
- I can't get thermal fusion to work - any idea here?

wrong CRC in ui.d\config.d\conf.cfg ??

edit: I saw you found a solution for a hard reset.
You can also press the power button for 10 seconds - until the red LED inside the camera (visible near the SD slot) shut off.


don't rename original files

Remember that (AIUI) all config files in a folder are scanned, in alphabetical order so if you find somewhere that a setting appears to be set, you should be able to override it by adding another rsc file with a later alphabetical name.

you only need two files, see my Exx config here:
https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg371680/#msg371680

just for fun I activated MSX with

Code: [Select]

> type \FlashFS\system\service\appcore.d\config.d\conf.cfg
....
caps.config.image.framegrab.fusion.hcf.enabled bool true
but read this:

If you have a Exx without MSX (year 2012) you can activate the MSX menu but you only see a live real image on the LCD.
If you take a picture, then you save a normal MSX jpg on your SD card.

I think, the MSX code is embedded in the windows CE binaries but not in the fpga code.

You can take PiP images and convert then with Flir Tools to MSX images.

with my config files I can change the PiP size smooth over the touch screen
if required: as workaround for MSX I zoom the PiP to fullscreen, then takes the PiP images and convert the image with flir tools to a MSX image

[ixfd64]

It was happen in this thread at about page 270

Page numbers are not meaningful, as users can configure the number of posts per page - for me this thread isn't up to 100 pages yet.

Direct links to posts would probably be more useful.

[Pauloven]

Aurora, your lens collection is pretty amazing.

I loved the DIY telescope posted before, looks like the way to go for me. Shame the image is inverted. If I get a Zense lens with a lower focal I'll post results.

[Fraser]

@Pauloven,

I am very pleased with the lenses that I have managed to find to date. I think I have all that I need for now.

I use the lenses with a FLIR PM695 but they work equally well on the E4. Their size is overkill for the E4 though as my PM695 has very large optics at around 55mm diameter. Smaller lenses should work OK with the E4.

I am presentely committed to other tasks so sadly have not had time to 'play' with the lenses on the E4. I will post images when I get a spare few minutes. I will then work on sorting out the image inversion in the Inframatrics X3 telescopes. Note that the Inframetrics Telescopes are circa 1980's but the optics are superb quality. These cost me around $150 on e*ay. Bargain lenses, even though they invert.

Aurora

[Rainer]

Hi guys,

bad news, I now have a very expensive paperweight: downgrading went fine (well, except for a couple of complains here and there but not of them looked that bad. didn't think to copy/paste the log before hitting "reboot"....) and then, upon reboot of the unit, I got a FAT partition mounted on my laptop with 2 files, ERROR.TXT which says "no error" (how ironic) and TYPEINFO.TXT which has

FLIR cam boot
MSDcmd 1.3
ASCO

and then 2 serial (including the one from the unit) and the ethernet MAC of the unit. The unit itself just displays the FLIR logo.

I suppose my best bet is to return it, unless somebody has any brilliant ideas ? (don't feel sorry. Gambling implies losses...)

So there *is* something lurking at the firmware level, I would say...

And a couple of posts later, he said, the device is already connected but has a empty Filesystem...



For the MSX on E40-TIC: In E4 are some variables:
.ui.setup.fusion, (for example: .ui.setup.fusion.fusionAlways bool true),
.image.services.channel..active text "FUSION"  with ["IR" "VISUAL" "FUSION"] as options

maybe one of this is also in the E40 and made MSX visible in the screen of the TIC

And in config (.caps.) of the E4 are this variables:

.caps.config.image.framegrab.fusion.enabled bool true
.caps.config.image.framegrab.fusion.hcf.enabled bool true
.caps.config.image.framegrab.fusion.pip.enabled bool true
.caps.config.image.framegrab.visual.enabled bool true
.caps.config.ui.image.enabled bool true
.caps.config.ui.image.startMode text "HCF"

[mucek]

As I see, it's kind of a problem, because FUSION on E60 stands for so called Thermal Fusion function (which makes part of image IR and part visual, depends on temperatures; i.e. let it be everything over 30 degrees in IR and everything bellow 30 degrees in visual).
As I see now, there is also FUSION word now, used for MSX function (actually I don't even know, if Thermal Fusion exists on cameras with MSX - can someone check this?), which is a bit confusing ...

Regards,
Gregor

[DaveWB]

WATCH OUT:Someone reported that TEquipment is selling 1.22.2 so maybe they patched the new hack.

[Methodical]

Someone reported that TEquipment is selling 1.22.2 so maybe they patched the new hack.

I just today received an E4 from TEquipment and it had 1.22 on it.  Maybe I got lucky.  TIConfig worked like a charm.

[strantor]

Ah carp. I just ordered from amazon prime :"flir systems" - wondering if that means direct from flir. If so, I'll probably get this 1.22.2. We will see; supposed to arrive tomorrow by EOD.