Poll

Has the hackabiliy of the E4 made you buy one :  

Yes, I was already looking at the competition at a similar price, but the hack swung it to E4
238 (26.3%)
Yes, I'd not considered buying a TIC before, but 320x240 resolution at this price justifies it (as either tool or toy!)
425 (47%)
Yes, I was going to buy an E5/6/8 class of unit but will now get the E4
43 (4.8%)
No, but am looking out for a cheap i3 to hack
41 (4.5%)
Not yet, but probably will if now that a closed-box hack becomes is possible
158 (17.5%)

Total Members Voted: 780

Author Topic: Flir E4 Thermal imaging camera teardown  (Read 2633883 times)

0 Members and 3 Guests are viewing this topic.

Offline sofisticated

  • Contributor
  • Posts: 23
Re: Flir E4 Thermal imaging camera teardown
« Reply #5600 on: October 15, 2014, 10:23:46 pm »
I've troubled as you. Then a friend suggested Mike's first posts for injecting RNDIS file to device. His file package includes related FIF files to activate it. It worked for me.


'If you search through Mikes original hack you can enter RNDIS mode using flirinstallnet and the FIF files from Mikes earlier hacks.'
 

Offline compet17

  • Regular Contributor
  • *
  • Posts: 87
  • Country: ch
    • Youtube - Play with Junk
Re: Flir E4 Thermal imaging camera teardown
« Reply #5601 on: October 16, 2014, 07:54:50 am »
Thanks for the hint... I will try this. Where can I find this tools and how do I "inject" the files?

In Mikes video, he's playing with a serial connection and displaying some startup logs. Has someone ever tried to communicate with the cam through that serial port? I wonder which pins a re used...
Sometimes amazing things can be achieved with a simple RS232 connection. Maybe even activating hidden menus or options.
« Last Edit: October 16, 2014, 07:56:25 am by compet17 »
 

Online mikeselectricstuff

  • Super Contributor
  • ***
  • Posts: 11938
  • Country: gb
    • Mike's Electric Stuff
Re: Flir E4 Thermal imaging camera teardown
« Reply #5602 on: October 16, 2014, 08:00:33 am »
Thanks for the hint... I will try this. Where can I find this tools and how do I "inject" the files?

In Mikes video, he's playing with a serial connection and displaying some startup logs. Has someone ever tried to communicate with the cam through that serial port? I wonder which pins a re used...
Sometimes amazing things can be achieved with a simple RS232 connection. Maybe even activating hidden menus or options.
The pinouts are listed early in this thread.
I don't think anyone has checked to see if the serial console is still present in firmware 1.2x or later
Youtube channel:Taking wierd stuff apart. Very apart.
Mike's Electric Stuff: High voltage, vintage electronics etc.
Day Job: Mostly LEDs
 

Offline sofisticated

  • Contributor
  • Posts: 23
Re: Flir E4 Thermal imaging camera teardown
« Reply #5603 on: October 16, 2014, 09:01:06 am »
Here is an old package of tools at attachment. It includes FIF files.

You need to install Flir Tools first. Then you should go manually to C:\Program Files (x86)\FLIR Systems\FLIR Tools\bin and find flirinstallnet.exe file. By clicking it brings the screen that you can inject .FIF files to your device. Grab according Temporary or Permanent RNDIS.fif file from package and it will activate RNDIS mode. Any how the hidden menu for USB connection selection from E4 is not becoming active after all but you can use flirinstallnet.exe to activate temporary or permanently or removing RNDIS mode.

 
The following users thanked this post: Ice-Tea

Offline bookaboo

  • Frequent Contributor
  • **
  • Posts: 603
  • Country: ie
Re: Flir E4 Thermal imaging camera teardown
« Reply #5604 on: October 16, 2014, 09:50:06 am »
Thanks for the hint... I will try this. Where can I find this tools and how do I "inject" the files?

In Mikes video, he's playing with a serial connection and displaying some startup logs. Has someone ever tried to communicate with the cam through that serial port? I wonder which pins a re used...
Sometimes amazing things can be achieved with a simple RS232 connection. Maybe even activating hidden menus or options.
The pinouts are listed early in this thread.
I don't think anyone has checked to see if the serial console is still present in firmware 1.2x or later

No need to break out the serial port to enable RNDIS, this can be done with Mike's flirinstallnet.exe hack from way back.
Once you have uploaded the FIF file you can then connect via USB and Filezilla as normal, I had played around with a friends 2.3.0 unit and was able to modify files but could not get any upgrade to work in the time I had it.
 

Offline compet17

  • Regular Contributor
  • *
  • Posts: 87
  • Country: ch
    • Youtube - Play with Junk
Re: Flir E4 Thermal imaging camera teardown
« Reply #5605 on: October 16, 2014, 08:32:34 pm »
Ok that's a lot of useful information. Thank you all. I will try this next week and report whatever I find out :-)
 

Offline FireBird

  • Regular Contributor
  • *
  • Posts: 56
  • Country: at
Re: Flir E4 Thermal imaging camera teardown
« Reply #5606 on: October 16, 2014, 10:40:46 pm »
According to the Flir updater pdf, there is a way to manually select the firmware fif and eFLIRInstall.exe. Has a 2.x user ever tried what happens if the 1.22 fif and exe are selected for upload?
 

Offline compet17

  • Regular Contributor
  • *
  • Posts: 87
  • Country: ch
    • Youtube - Play with Junk
Re: Flir E4 Thermal imaging camera teardown
« Reply #5607 on: October 17, 2014, 07:57:10 am »
I'm a couple of steps further.... i got an FTP connection, could download the conf.cfc from the camera and tried to decrypt it with ftool.exe.

And then I get the error "tail part 2 invalid"   What does that mean? (attached conf.cfc from firmware V2.3.0, zipped)
« Last Edit: October 17, 2014, 08:06:29 am by compet17 »
 

Offline sofisticated

  • Contributor
  • Posts: 23
Re: Flir E4 Thermal imaging camera teardown
« Reply #5608 on: October 17, 2014, 08:56:44 am »
It means that old ftool can not decrypt your config file. You should find private key to decrypt with some other tools. Then a new ftool can be decompiled from that point to make easy decryption like before.

You can play with system setup menu over browser (write 192.168.02 in firefox adress and you will see a system menu. But also when you click detailed service tabs it will give http 401 error. System service web files are not present in your device also, but you can copy old firmware's web cluster to your device with ftp and valaaa, now you will have your system service tabs active and working   -this page's loading time is a little long maybe 40 seconds). There is a tab for EEPROM settings which you can change your device serial number and model and many more things. Thomas has changed his device's model name to E8 and updated again, now he has E8 as he mention. But new devices eeprom unlock password is not 1235. I believe finding EEPROM unlock password will help to find public key in system's config files encryption. So trying to make brute force attack on that web service. But until now I couldn't penetrate Burp Suite correctly because of web service works with authentication with username flir and pswrd 3vlig.   


PS: My Reply #5597 has those web service files.
 

Offline compet17

  • Regular Contributor
  • *
  • Posts: 87
  • Country: ch
    • Youtube - Play with Junk
Re: Flir E4 Thermal imaging camera teardown
« Reply #5609 on: October 17, 2014, 10:10:10 am »
I'm not a decryption specialist but the plaintext (decrypted) file will not differ much from the old cfg file... so I have a encrypted file and I know the plaintext. Finding the key should be easy in this case. The question is what tool can I use to brute force the file...?
 

Offline compet17

  • Regular Contributor
  • *
  • Posts: 87
  • Country: ch
    • Youtube - Play with Junk
Re: Flir E4 Thermal imaging camera teardown
« Reply #5610 on: October 19, 2014, 10:37:37 am »
A notice regarding this error:

"Application Error" (An OK button displays on the top right corner)
"Application appcore.exe encountered a serious error and must shutdown".

I got this error one time on my brandnew, not modified, not even tried to modify E4. I got this after switching it off/on a couple of times.
Seems not to be a real problem... it's WINDOWS inside :-) Sudden crashes must be accepted.

Action taken: Removed battery and rebooted.
 

Offline tmbinc

  • Regular Contributor
  • *
  • Posts: 173
Re: Flir E4 Thermal imaging camera teardown
« Reply #5611 on: October 21, 2014, 08:04:44 am »
I have a potential, albeit "dirty" (won't survive firmware upgrade, for example) solution for E4 cams that came with 2.3.0. It gives upgraded resolution _only_ (for now). But before widely releasing it, I'd like to test it on a few more devices.

So if anyone
 - feels adventurous (although unlikely, it could simply not work, or even brick your camera, or maybe create a black hole and swallow up earth),
 - has an E4 that _came_ with 2.3.0 (though it should work with upgraded units too, but let's start with known facts),
 - already has experience with the Flir E4 (including setting up RNDIS mode, ftp access, telnet)
please send me a PM and I'll supply you with a tool. I promise(*) that once the hack turns out to be useful I'll publish it here.


(*) You should not believe any promises from random strangers on the internet.
 

Offline cenkaetaya

  • Newbie
  • Posts: 2
Re: Flir E4 Thermal imaging camera teardown
« Reply #5612 on: October 21, 2014, 01:34:37 pm »
Hi,

Can someone tell me if this hack works on the FLIR E5?

Thank you
 

Offline bookaboo

  • Frequent Contributor
  • **
  • Posts: 603
  • Country: ie
Re: Flir E4 Thermal imaging camera teardown
« Reply #5613 on: October 21, 2014, 01:56:53 pm »
If it is V1.22.0 or before then there is no reason why not.
 

Offline tmbinc

  • Regular Contributor
  • *
  • Posts: 173
Re: Flir E4 Thermal imaging camera teardown
« Reply #5614 on: October 21, 2014, 09:38:18 pm »
Ok, whatever, here's a firstsecond version.

From the readme:

Please check if your /FlashFS/system/appcore.d/config.d/conf.cfc is 6608
bytes.

If that's the case, that sounds good. Otherwise, this hack is not for you.

 - Download+install python2 (not python3)
 - Download+extract this zip
 - Set Camera to RNDIS mode
 - run "apply.py apply <ipaddress of camera>". If it fails, please provide
   the output for diagnostics.
 - Hard-Reset the camera


Let me know if anyone has problems using this.

EDIT: If you get "550 File unavailable", please just re-run the script. I'll work on a better fix. If retrying doesn't work, let me know.
EDIT: tried to fix the "550" issue with more retries. Seems killing the app sometimes keeps the DLLs busy for "a while" (for whatever definition of that). Let's hope this helps.

IF YOU STILL HAVE ISSUES WITH "550" with v0.3, let me know. You can always resort to manually uploading the binaries if you want - they are preserved if upload fails.

EDIT2: Added v0.4.zip with support for the E5.
« Last Edit: October 26, 2014, 06:08:47 pm by tmbinc »
 
The following users thanked this post: Ice-Tea

Offline miguelvp

  • Super Contributor
  • ***
  • Posts: 5549
  • Country: us
Re: Flir E4 Thermal imaging camera teardown
« Reply #5615 on: October 21, 2014, 10:56:12 pm »
They probably should make a backup first :)
 

Offline warcow

  • Contributor
  • Posts: 9
Re: Flir E4 Thermal imaging camera teardown
« Reply #5616 on: October 22, 2014, 06:04:46 am »
tmbinc,

Your update is for getting the resolution to the e8 (max) setting right? What are the probabilities for getting other functionalities working, like the e5's (and up) Min and Max hotspot? We are looking to get an Ex (4 or 5) camera and not sure what the firmware version will be. If chances are that the newest firmware can also be hacked soon we don't have to worry too much and go for the E4 model.
 

Offline sofisticated

  • Contributor
  • Posts: 23
Re: Flir E4 Thermal imaging camera teardown
« Reply #5617 on: October 22, 2014, 08:58:14 am »
Ok, whatever, here's a first version.

From the readme:

Please check if your /FlashFS/system/appcore.d/config.d/conf.cfc is 6608
bytes.

If that's the case, that sounds good. Otherwise, this hack is not for you.

 - Download+install python2 (not python3)
 - Download+extract this zip
 - Set Camera to RNDIS mode
 - run "apply.py apply <ipaddress of camera>". If it fails, please provide
   the output for diagnostics.
 - Hard-Reset the camera


Let me know if anyone has problems using this.


I've tried that hack but unluckily it didn't work at first trial. You can see the screen shot of dos screen. Resolution was the same at hard boot.

Then I've applied v0.1 of that hack which tmbinc sent previously (last night with PM) . And it gave a real hack for resolution. Thank you very much tmbinc on behalf of new fw 2.3.0 E4 owners.  :-+

(v0.1 is doing the same file replacements; but it is manually with FTP and Telnet command.)

Tugbay
« Last Edit: October 22, 2014, 09:00:52 am by sofisticated »
 

Offline tmbinc

  • Regular Contributor
  • *
  • Posts: 173
Re: Flir E4 Thermal imaging camera teardown
« Reply #5618 on: October 22, 2014, 10:25:59 am »
Ah, I see. For everybody getting the "550 File unavailable" error, it _appears_ to help if you just try again (re-run the script with same arguments).

I'll see if I can come up with a better fix.
 

Offline tomas123

  • Frequent Contributor
  • **
  • Posts: 832
  • Country: de
Re: Flir E4 Thermal imaging camera teardown
« Reply #5619 on: October 22, 2014, 10:51:40 am »
only two bytes in common_dll.dll !
great work  :-+


Offline compet17

  • Regular Contributor
  • *
  • Posts: 87
  • Country: ch
    • Youtube - Play with Junk
Re: Flir E4 Thermal imaging camera teardown
« Reply #5620 on: October 22, 2014, 11:11:20 am »
I can confirm that the "resolution improvement" v0.1 works for an newly bought E4 (V2.3.0) camera. I also tried v0.2 and it has a problem finding the files to send back to the camera. Maybe only a file-path naming problem... So I did it manually with Windows-CMD/FTP

Great job!!!  :-+ :-+

BTW: I got the information that FLIR did not only reduce the resolution but also installed a noise generator to further impair the picture... I think this is a bad move, only that they can say "see, how much better our E8 model is!"
Fortunately the upgrade eliminates also the noise, which is very good visible.

Such manufacturers deserve to be hacked!  :rant:
« Last Edit: October 22, 2014, 01:27:13 pm by compet17 »
 

Offline tmbinc

  • Regular Contributor
  • *
  • Posts: 173
Re: Flir E4 Thermal imaging camera teardown
« Reply #5621 on: October 22, 2014, 12:00:52 pm »
If the final upload fails, the patched files are not removed, so you can manually upload them. (But remember to execute "stopapp" via telnet before doing so, if you didn't let the script doing it.)

- upload common_dll.dll to /FlashBFS/system/
- upload conf.cfc to /FlashFS/system/appcore.d/config.d/

Not sure why deleting common_dll.dll fails sometimes.
 

Offline warcow

  • Contributor
  • Posts: 9
Re: Flir E4 Thermal imaging camera teardown
« Reply #5622 on: October 22, 2014, 01:21:27 pm »
Just ordered the Flir E4, looking forward to try your patch/update, tmbinc! :)
 

Offline Iphone_hack

  • Contributor
  • Posts: 43
Re: Flir E4 Thermal imaging camera teardown
« Reply #5623 on: October 22, 2014, 03:55:26 pm »
If the final upload fails, the patched files are not removed, so you can manually upload them. (But remember to execute "stopapp" via telnet before doing so, if you didn't let the script doing it.)

- upload common_dll.dll to /FlashBFS/system/
- upload conf.cfc to /FlashFS/system/appcore.d/config.d/

Not sure why deleting common_dll.dll fails sometimes.

Great job
So here we go again
I am sure flir will start selling E4 like crazy
I know you just got it working

Could you or someone post all the instructions step by step
Even how to connect the new E4 to computer from the beginning
I am sure new member will be interested too
Thanks
 

Offline macsisi

  • Newbie
  • Posts: 1
Re: Flir E4 Thermal imaging camera teardown
« Reply #5624 on: October 22, 2014, 08:04:09 pm »
If the final upload fails, the patched files are not removed, so you can manually upload them. (But remember to execute "stopapp" via telnet before doing so, if you didn't let the script doing it.)

- upload common_dll.dll to /FlashBFS/system/
- upload conf.cfc to /FlashFS/system/appcore.d/config.d/

Not sure why deleting common_dll.dll fails sometimes.



I tried the procedure with v0.2 on my camera which runs 2.3 firmware and model number is 1.2L and indeed it gave me an error not to find proper files. But using FTP I could easily overwritten the two files and now my camera works at 320x240 resolution. Great hack indeed and most of all it works.
At first the center point was a bit off, but after a reboot everything is OK now.

Thanks!
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf