Flir E4 Thermal imaging camera teardown

[Svoy]

Hi,

I have an E4 1.2L with firmware 2.3
Is it worth to upgrade to the latest 3.16.xx firmware version before applying the liberation process?
Which are the major differences in new firmware version? I can't find a firmware release note.

Thanks in advance

[Jane]

How can I save pictures from the camera to computer (PC)?
When i connect camera to PC, PC sees that the camera was connected but in Device manager it shows as USB serial device (COM 7) only. And it is not seen in File manager.
Is it possible to save picture from the camera after the hack?
Firmware in camera is  2.11.0.
Thank you.

[Bud]

The camera may be in RNDIS permanent mode. If so, you need to remove RNDIS in order for the computer to connect to the camera storage via USB.

[Jane]

Thank you for your reply. But how can I remove RNDIS?

[Bud]

Try searching this thread for "remove rndis".

[smaultre]

Hello my friends! Got a Used E5 2.0L with 3.12.0 soft.
Trying the method described here but the image info says, that the resolution is still 120x90.
I make all that described on Bud's post https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1397359/#msg1397359 Twice!!
All operations goes without errors, the new menu appears but no success with resolution.  I'm trying to change app E4 to app E5 in conf.cfg..
Can anybody help with this?

[Bud]

Changing E4 to E5 will not have any effect.
Even with instructions people make mistakes. Common mistakes are using SUID instead of the camera Serial Number in the config file, and leaving the old renamed config file in the folder on the camera so tgere are two config files.

[smaultre]

Hello!  Bud, thank you so much
Of course "... leaving the old renamed config file in the folder on the camera.."

[michaelrcolton@gmail.com]

I just picked up a used E4 and it reeks! It works perfectly, I've already applied the hack (thanks guys!) but it's got an unbearable mildew smell that stays on clothes and hands.

I want to take it apart so I can clean it more thoroughly, but the only teardown info I can find is the original video and the way the trigger screw is accessed seems pretty destructive (it's also not clear to me in the video if the little arm that pushes the button is damaged in the process or if it's supposed to look like that.)

After all this time, does anyone know of a better way to remove the trigger or otherwise access that screw? Any advice?

I've tried looking through past posts, sorry if I missed it. Thanks!

(P.S. Is there any benefit to updating the stock firmware to the latest hackable version? I realize I'd have to reverse the hack first. Mine's running 3.13)

[salvagedcircuitry]

I have successfully unlocked an E5 firmware 3.12.0 Thanks a ton guys!

References:
   https://fubar.gr/hacking-the-flir-e4/
   https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1397359/#msg1397359

Since it's so commonly omitted from how-to guides here's how to enable RNDIS:

• Install Winscp, putty, filr drivers, flir tools, python 2.7 on a win7 x32bit machine with usb2.0. Restart machine.
• Open FLIR tools and connect to the camera. open C:\Program Files\FLIR Systems\FLIR Tools\bin\FLIRInstallNet.exe Under Camera you should see "FLIR USB video." That means the drivers were installed correctly and the tool can communicate with the camera.
• Make a directory in Local disc C called C:\FLIRfif. In this folder, put all the files from "FLIRfif" that are included in the Flir_E4_2.3.0_hack.zip
• In Flir tools, hit browse, navigate to C:\FLIRfif, select Set_RNDIS_permament.fif and hit the Run FIF button. flir tools sometimes does not finish loading. Green bottom loading bar goes to 100% but the console log does not display anything. Try a combination of hitting run then browse then run again. Whenever the console log starts showing a report, the software is working.
• When the program has finished running, remove and replace the battery from the camera to do a hard reset (the camera doesn’t turn off completely with the on-off button, it simply goes to low-power mode). Leave USB connected. Turn the camera on. Windows will again start searching for drivers, because now it is in RNDIS mode and needs a different set of drivers.
• On the camera, go to settings > device settings > camera info > hold right button for 15sec > select usb mode. It should say "RNDIS." RNDIS USB mode enables you to edit the file system even if something goes wrong with the upgrade. "UVC and MSD" is the stock option. Allows for easy image file transfer to PC. You can't just select RNDIS mode through the camera, you have to enable it.

The key takeaway is that the "Set_RNDIS_permament.fif" and "Remove_RNDIS_permament.fif" method are still appropriate ways of enabling and disabling RNDIS mode as described in more detail in the fubar.gr link.

[Bud]

I do not recommend using permanent RNDIS during upgrade, use Temporary RNDIS instead. If you use Permanent,  if anything goes wrong with the network setup or driver, or the camera gets stuck before it boots, you may end up with a brick because there will be no way to connect to it. If you use Temporary, the camera will return to USB mode after a reboot. This is a reliable way to keep control over the camera. Once you successfully upgrade then you can use Permanent if you wish.

[salvagedcircuitry]

I grabbed a second E5 for my brother off ebay and to my surprise its stuck on the boot logo. I could just send it back to the seller, but I figure I'd just have a look.
It shows up as a storage device when plugged into a PC
It's recognized as "flir usb video" in flir tools.
I ran a flir upgrade fif for 3.12 (flir_ex_pn639_v3.12.0_update_pack) and it installed the 3.12 firmware but it still hangs on boot. I tried 3.16 from flir's website as well in case it was a newer E5. I attached the install log file. Very seldomly, the camera boots into a blue screen mode with the standard navigation menu. I an able to navigate to the settings and reset the camera. The same thing happens again following the reset, it hangs on boot.

Things I've noticed:
when the camera is in blue screen mode, the model says "E5 1.1L"
The storage says "*" which is concerning.

Is it possible that the fif I used was for a newer model number version? Do I need to find a FIF file for E5 1.1L versions?
Thanks

[Bud]

The storage says "*" which is concerning.

I recall E4 for one does not show the storage information or allows access to it from the keypad when connected to a computer. So this may be normal.

[salvagedcircuitry]

The storage says "*" which is concerning.

I recall E4 for one does not show the storage information or allows access to it from the keypad when connected to a computer. So this may be normal.

Yes. When I unplug usb, it still displays "*" for storage and 0 degrees for lens though. I can only get the E5 to go to blue screen mode when plugged into usb and connected via flirtools.
I am thinking of flashing an older fif and trying to go from there. Is it possible to run a recovery process, or double check of the sensor calibration files are still intact?
Thanks.

[Bud]

If you connect an external charger, does the camera show the battery charging screen ?

[salvagedcircuitry]

If you connect an external charger, does the camera show the battery charging screen ?

It shows the charging icon when powered off and plugged into usb.

[Bud]

If the camera was, ehhm... modified, and someone run a firmware upgrade on top of it at some point, that could cause the camera to hang on boot.
I'd recommend you use the Temporary RNDIS fif and get access to the filesystem via FTP, then replace the stock DLL with the modified one of the respective version. You can find a needed DLL in the other E4 thread.

[salvagedcircuitry]

If the camera was, ehhm... modified, and someone run a firmware upgrade on top of it at some point, that could cause the camera to hang on boot.
I'd recommend you use the Temporary RNDIS fif and get access to the filesystem via FTP, then replace the stock DLL with the modified one of the respective version. You can find a needed DLL in the other E4 thread.

Thanks for the input! That seems highly likely.
I backed up the camera, and was able to write the temp RNDIS fif to the camera. It hung on boot directly afterwards and took 4-5 times of power cycling to get it to boot back to a blue screen, then I checked and "UVC and MSD" mode was still enabled unfortunately. Strangely, I was able to connect to the E5 via ftp to transfer and edit files on the device even though I was not in RNDIS mode. I transferred the common_dll_3.16.zip in post #788 restarted and still, it hangs on boot.

Edit: finally after an hour of waiting, its back in blue screen mode and its displaying common_dll as version 1.22.1.1. on the camera. When I flash the temp RNDIS fif, FTP into the E5, it's telling me the common_dll.dll is present on the E5 alongside common_dll_org.dll. I repeated the process again and used telnet to stopapp and re-transferred the common_dll.dll from the 3.16 zip and it still hangs on boot.
This one's really stumping me. Dang.

[Bud]

Then you should act on the config file next. Check if there is one conf file in the folder. If there are other copies in the folder, move them to the computer for backup and delete from the camera. Try booting after that.
If only one config, work on it to decrypt it and see if it decrypts properly. Check then if the content was modified for resolution and stuff.

[salvagedcircuitry]

Then you should act on the config file next. Check if there is one conf file in the folder. If there are other copies in the folder, move them to the computer for backup and delete from the camera. Try booting after that.
If only one config, work on it to decrypt it and see if it decrypts properly. Check then if the content was modified for resolution and stuff.

Interesting. There is only one conf.cfc file in the FlashFS\system\appcore.d\config.d\ directory on the E5. It is dated 5/19/2014, so It may be the original config file for the camera.

I followed the same guide for the V3.12 install and used the suid to decrypt and create the cfc file. I did not notice any errors with this process. I telnet-ed in, halted the flir software, swapped out the common dll and the cfc file. I did not power off in between because I wanted to avoid a boot hang. I powered off and it still hangs on boot. 
While digging up the SUID, I compared the FLIRvers.rsc on the 1st working E5 to the E5 that hangs on boot, and the values for power.states are different. The proper E5 lists the values as true. The other E5 has them listed as false. I have no idea if that is related but I figure the files would be configured identical except for the device specific hex values.

Is it possible that the hardware firmware is just too old for the software? Maybe the previous owner updated the software to 3.16 and not the firmware?
I previously tried factory resetting the e5 and the boot hangs still occur.
Note: these are not zip files. remove the .zip for the proper file extension

[Bud]

You can try replacing the other files from the Basic package from the other E4 thread (keep the updated 3.16 DLL). If that won't help then the camera may be damaged, as it seems it is not talking to the thermal module.
I do not know of a possibility of the hardware being too old for new firmware. I'd think Flir Tools would be smart enough to not allow firmware updates in this case.

[charlyd]

Hi i am new to this topic and will be the owner of a Flir E4 v1.21 ( hw 1.1L ) soon.  for my model i found the howto and the files like TOOLS1.zip and ADDMENU-BETA3.zip   but i am curious after a succesfull upgrade on what level i will be..... is it 2.30(E8) , i am completel lost there...

i read a lot of info on this topic and understand there are many different versions which can be upgraded.
but is there a real upgrade path which can be followed for everybody to understand..  i will make a small excel tabel for what i discovered until now.

my opinion is that i am wrong with my conclusion but help/advise wanted.

people like me have or bought a Flir E4 from a specific version and where can we jump into the upgrade path?

do i understand right if all E4 model (v1.xx ) after they are upgraded they are on version V2.30(E8) (yellow) or compatible with v2.30(E8) ?
and from there on can be upgrade by Flir GUI sofware to v2.8 or ...? or is this even a misunderstanding?

if not can someone explain to me and others on this forum new on this topic, on how these upgrade path work to fully understand what to do and which way to go or not no go..
because we all don t want to brick our units by going the wrong path..

because i also read post from version downgrades, then i am totally lost...., why should that be done?

you see many questions but who can clear them up for us newby's 


after reading over and over again.. many page of this topic..   i think it is a bit more clear for me:

first you change your E4 into a E8 with the  RESOLUTION HACK and the MENUADD and afterwards you run the firmware upgrade??  to the latest ..2.8 or.?
 is that how it works?
 
or from what i saw later first upgrade your device to 2.3.0  and then do the hacks.. ? 

who can jump in and let me know what the best choice is. 

What FW version to stay/upgrade/downgrade to  and then do the resolution and menu hack?


      
      
      
      
      

[Bud]

Do Not confuse official Flir firmware version upgrades with EEVBlog (let me call it that way  )feature unlocks.

The general advice is: if EEVBlog feature unlock was applied, after that to Not ever perform Flir firmware upgrade as this may brick the device.
So you upgrade the Flir firmware first, then apply EEVBlog feature unlock for the respective firmware version. But before rushing to do Flir firmware upgrade make sure your camera was not already unlock-ized.

Applying EEVBlog unlock does Not change the firmware version. It only unlocks some features available in more expensive models.

[charlyd]

ah ok thats is a good one. @BUD thanks for your reply

i heared the Flir E4 which is on the way has already the resolution hack and menu add.  The current E4 version is 1.21.
but what is the benifit off rolling back the resolution and menu hack.

To ask with other words:
i want to use this Flir E4  for PCB check/inspection.
is there a difference between  V1.21.  hacked.  or v2.3.0  hacked?   if there is. ...  is it simple to rolback the hack?

[Bud]

No difference for your purpose, because both will have same 320x240 resolution.
To "roll back" the mod you simply replace the updated files with the original ones. But it must be the original files from that specific firmware revision.