Poll

Has the hackabiliy of the E4 made you buy one :  

Yes, I was already looking at the competition at a similar price, but the hack swung it to E4
241 (26.5%)
Yes, I'd not considered buying a TIC before, but 320x240 resolution at this price justifies it (as either tool or toy!)
425 (46.8%)
Yes, I was going to buy an E5/6/8 class of unit but will now get the E4
43 (4.7%)
No, but am looking out for a cheap i3 to hack
41 (4.5%)
Not yet, but probably will if now that a closed-box hack becomes is possible
158 (17.4%)

Total Members Voted: 749

Author Topic: Flir E4 Thermal imaging camera teardown  (Read 2649341 times)

0 Members and 6 Guests are viewing this topic.

Offline hikanio

  • Contributor
  • Posts: 28
  • Country: gb
Re: Flir E4 Thermal imaging camera teardown
« Reply #7825 on: May 21, 2016, 12:39:32 pm »
Flir E30 49001-1801 Serial # 492xx Success Report

Successfully updated the IR resolution, VIS resolution and E60 menu functions. :-)

Just a biit surprised, that the cam saves image files without the vis picture if not in thermal fusion or pip mode.
This is a slight discomfort as it prevents any Tools MSX conversion of the picture.

Also the 492xx cameras seem to miss the cmmunications board so wifi and bluetooth could not be enabled.

If anybody could confirm that the lack of the of the slbwver hw component really means the physical absence of the communications modul, it could save me from further investigation. ;-)

If anybody needs help with patching his Exx, you'll be welcome.

Cheers
hikanio


Edit: Post copied to 40 Thread:
https://www.eevblog.com/forum/thermal-imaging/flir-e40-upgrade-configuration/
« Last Edit: May 21, 2016, 04:06:13 pm by hikanio »
 

Offline tomas123

  • Frequent Contributor
  • **
  • Posts: 832
  • Country: de
Re: Flir E4 Thermal imaging camera teardown
« Reply #7826 on: May 21, 2016, 02:08:07 pm »
Flir saled different hardware versions of E30 (the first model miss a real camera)

user funzt successful upgraded an E30 with  ID 490xxxxx 

https://www.eevblog.com/forum/profile/?area=showposts;u=89829



thx Taucher
I put my E60 file as template.cfg in your great EzCRC01-V01-static
and that works!!! :clap:
and my E30 accepted it -->  :-+
now work with ui.d and wlan.....

there is a better thread for your questions:
https://www.eevblog.com/forum/thermal-imaging/flir-e40-upgrade-configuration/
Flir E40 Upgrade & Configuration

Offline mct75

  • Contributor
  • Posts: 49
  • Country: us
Re: Flir E4 Thermal imaging camera teardown
« Reply #7827 on: May 21, 2016, 02:22:46 pm »
ROC is inherent to the lack of steps in the hacking procedure apllied to the cameras which are inconsistent to certain firmware| software versions combinations. If it came once, it will come again. Typically, after extended use of camera, or over-warming. Suspected versions according my experience are: 2.3.0, 2.8.0 and the downgraded.   

Interesting!   I had attributed it to the menu hack, but I also used it for like 45 minutes straight staring at my urine in the toilet bowl (my girlfriend thinks I am weird now)

Is there a recourse for preventing the ROC?  I read some of the posts which had some success.  My camera has a calibration date of 03/07/2016 so I highly suspect it was downgraded before I got it (it was used and resolution hacked when it arrived)
 

Offline Solare

  • Regular Contributor
  • *
  • Posts: 134
Re: Flir E4 Thermal imaging camera teardown
« Reply #7828 on: May 21, 2016, 07:46:41 pm »
It might be possible to recover, if you have the original files.

What was your original firmware version, do you know? I cannot tell unless you tell you serial, which is not welcome here for a reason, but my guess is that you might have 2.11. What is the version now, as read in the Menu?

 

Offline mct75

  • Contributor
  • Posts: 49
  • Country: us
Re: Flir E4 Thermal imaging camera teardown
« Reply #7829 on: May 21, 2016, 09:15:48 pm »
The version now is 2.3.0, model is E4 1.2L, calibration is 2016-03-07, serial starts with 63975xxx (if that's the right amount of information)

Since mine came hacked, I have no copies of the "pure" files but I did make a backup of the files as they are on the camera now.   Not sure how much of a help that is.  So far the ROC has only happened once, I don't know if some get it more than others.
 

Offline DoricLoon

  • Contributor
  • Posts: 34
  • Country: gb
Re: Flir E4 Thermal imaging camera teardown
« Reply #7830 on: May 22, 2016, 12:07:36 am »
Hello Forum,

I've been keen on getting a thermal imager for a while now but felt it hard to justify the price of a decent one. The ability to upgrade the E4 to 320x240 definately swings the balance for me.
I had ordered an E4 from ebay with the intention of carrying out the mod. After ordering it I asked the vendor which firmware version the unit carried. Happily he responded with V2.3.0 which has clear and proven upgrade path  :) The following morning while rumaging through the posts in this thread I saw a bit about discounted units with lower sensitivity and temperature range. Immediate panic button went (lower spec model under the same model name?) Checked the ebay listing again and sure enough, not in the description but in the E4 spec table which followed the listing were the reduced (non standard) specs  :palm: Fortunately the seller was willing to cancel and refund.  :phew: So beware of cheaper than normal E4's there could be a nasty surprise.

So my question is this. Since the E5 is now available at the same price as the E4 (£723 @RSWWW) do all of the hacks work equally well on the E5?

I haven't seen any mention of firmware beyond 2.11 so presumably all existing models have (by the hard work of others  :clap:) the ability to be upgraded. Just thought that if sensor quality control goes on a sliding scale dependent on the model? Hacking the E5 rather than the E4 has less chance of dead pixels?

 

Offline Solare

  • Regular Contributor
  • *
  • Posts: 134
Re: Flir E4 Thermal imaging camera teardown
« Reply #7831 on: May 22, 2016, 12:49:06 am »
 :popcorn:

This is definitely 2.11.0 downgraded to 2.3.0 and then hacked the one you have there. It is known to have ROC, and, although can be manually tuned to remove it, this requires individual work with given camera (not trivial or reproducible solution, sorry).

The best option for you might be rollback to the 2.11.0 and try it with the new procedure discovered by 2 pls. So far, people do not report ROC after it.

Good luck!
 

Offline mct75

  • Contributor
  • Posts: 49
  • Country: us
Re: Flir E4 Thermal imaging camera teardown
« Reply #7832 on: May 22, 2016, 01:56:43 am »
This is definitely 2.11.0 downgraded to 2.3.0 and then hacked the one you have there. It is known to have ROC, and, although can be manually tuned to remove it, this requires individual work with given camera (not trivial or reproducible solution, sorry).

Is this tuning more skilled or just laborious?  I have some free time, but I'm still pretty new to WinCE hacking.

The best option for you might be rollback to the 2.11.0 and try it with the new procedure discovered by 2 pls. So far, people do not report ROC after it.

Good luck!
Is the upgrade something that can be reverted?  I know people have downgraded before (obviously mine was downgraded) but is there any extreme risk to it?  I'm very much a "measure twice cut once" type of guy when it comes to this stuff.




This reminds me of the PSP hacking scene back in 2005.  Everyone wanted software version 1.50 and went to great lengths to get a unit with that version.  Then the epic cat-and-mouse game began with Sony who kept patching exploit holes and locking people out of games until they updated.  The hackers would take the official firmwares, and patch them to still allow unsigned code.  Having a fully patched and homebrew capable PSP was a source of pride. 

The PSP was a device that had so much potential, but Sony wasted it on trying to force people to buy crappy ports and movies they already owned on a $30 UMD that only played in the PSP.  The homebrew scene was way more fun.  Ironically I spent most of my time playing Gameboy games on an emulator an listening to internet radio.   They even got it to boot Windows 95.   

Eventually the hackers figured out that there was a factory menu activated by an eeprom inside the battery of all things and the mystique of using exploits and patching custom firmwares disappeared.   But still, the real heroes were the homebrew software developers that really unlocked the potential of the PSP, just like the folks here are doing with the E4.  Brings a tear to my eye.
 

Offline Solare

  • Regular Contributor
  • *
  • Posts: 134
Re: Flir E4 Thermal imaging camera teardown
« Reply #7833 on: May 22, 2016, 09:36:02 am »
Everything can be done with a proper treatment, some amount of time, certain skills and knowledge and lots of will :) So you are not forbidden to try your best! Just be aware people here including me cannot really help you if something goes wrong.

What I am saying is that it is not a matter of patching something or updating few files or changing a string or too, i.e., it is not reproducible and shareable easily. You may be aware already that some files are specific to your camera, which means, cannot be shared, but only carefully edited with understanding each step and its effect on the camera, and controlling every loop and every branching of possibilities, and adjusting your hacking accordingly. Truly, this is really manual, individual and personal hacking, which is so much unlike "patch and go" hack we have here with E4 - E8+

That's why, I strongly recommend you to find original files from your camera and restore them, and them proceed as advised.

If this is absolutely impossible, try upgrading your camera back to 2.11.0. and re-apply the hacks (modified procedure and files for the 2.11.0). That may not work though, if some of original files is missing. In this case, ROC will persist.

You are on your own here, so take your risk responsibly!



 
 
The following users thanked this post: mct75

Offline mct75

  • Contributor
  • Posts: 49
  • Country: us
Re: Flir E4 Thermal imaging camera teardown
« Reply #7834 on: May 23, 2016, 05:08:34 pm »
I guess I don't understand what is happening well enough to go and make changes!   To me, that the camera works great until it's restarted while warm indicates that it has all the calibration it needs to function properly.  Still, not having the original files worries me.
 

Offline mct75

  • Contributor
  • Posts: 49
  • Country: us
Re: Flir E4 Thermal imaging camera teardown
« Reply #7835 on: May 23, 2016, 10:36:21 pm »
I used the "2lps" method and was able to upgrade to 2.11 and apply the reshack, as well as keep some of the advanced menu options.

What I did, basically (not to imply these methods are anything I came up with) was:

  • remove "permament" RNDIS mode (I had left it on)
  • update FLIR tools (it won't allow an update of the camera until you update tools)
  • from the update camera menu, I manually specified the 2.11 files (might not be required unless you're downgrading)
  • flash 2.11.  I lost both the menu hack and the res hack on mine
  • go back into permament RNDIS mode, reboot
  • use Filezilla to apply the 2lps common_dll.dll file
  • remove RNDIS mode
  • reboot and have reshack and some extra menu options

So far I haven't seen the ring of crap, but I suspect it's indeed fixed if 2lps had success with it.   I'm pretty miffed about the lack of the more advanced menu options.  Ironically I liked the "no display" option the most, as there was nothing on the screen but the image.  Less stuff to distract me.  If there's a way to remove the FLIR logo and temperature scale I'd consider 2.11 to be a real winner.
 

Offline mct75

  • Contributor
  • Posts: 49
  • Country: us
Re: Flir E4 Thermal imaging camera teardown
« Reply #7836 on: May 24, 2016, 09:25:52 pm »
Well, I broke it.

I decided to downgrade to 2.3.0 to experiment with the Ring of Crap some more, and when I did I managed to get 80x60 and ROC at the same time.  Totally not fair.  I did the reshack python script and it's still stuck at 80x60 on 2.3.0.  Tried uploading my backed up common_dll.dll (that was working on 2.3.0 when I got the camera) and no change.  Defeated, I went back to 2.11.0 and now that is at 80x60 too, and 2lps's patched common_dll.dll isn't even fixing that.   
 

Offline 2lps

  • Contributor
  • Posts: 28
  • Country: bg
Re: Flir E4 Thermal imaging camera teardown
« Reply #7837 on: May 24, 2016, 09:50:59 pm »
With 2.11 firmware:

1. Upload the backup of your conf.cfc to /FlashFS/system/appcore.d/config.d/
2. Upload common_dll.dll (downloaded from my URL) to /FlashBFS/system/
3. For the menu hack, upload the ui_control.rsc (I sent you a message with a download URL) to /FlashBFS/system/appcore.d/factory.d/
4. Restart

It is safe to execute the hacks when you have the original conf.cfc. Yours is already patched and I am not sure what happens when you try to patch it again. This is why I am sending you individual files, extracted from the hacks.
« Last Edit: May 24, 2016, 09:58:39 pm by 2lps »
 
The following users thanked this post: mct75

Offline 2lps

  • Contributor
  • Posts: 28
  • Country: bg
Re: Flir E4 Thermal imaging camera teardown
« Reply #7838 on: May 24, 2016, 10:19:47 pm »
Step 3 from my previous post is when you already have the menu hack applied. E.g. you applied it on 2.3.0 and then upgraded to 2.11. It will work based on when you made the backup of conf.cfc - before you applied the menu hack or after it.

If your backup of conf.cfc is before the menu hack, then instead of copying an individual file in step 3, just apply the complete menu hack again.
 
The following users thanked this post: mct75

Offline mct75

  • Contributor
  • Posts: 49
  • Country: us
Re: Flir E4 Thermal imaging camera teardown
« Reply #7839 on: May 24, 2016, 10:54:36 pm »
My 2.11 upgraded camera had no config.d directory inside appcore.d, but I copied it over from a backup of the original files that were on my camera when I got it.   Sadly I'm still stuck at 80x60 even with the new common_dll.dll.
 

Offline 2lps

  • Contributor
  • Posts: 28
  • Country: bg
Re: Flir E4 Thermal imaging camera teardown
« Reply #7840 on: May 25, 2016, 03:36:25 am »
Are you sure that you are looking at the correct folder?

There is FlashFS and there is FlashBFS. The conf.cfc is inside /FlashFS/system/appcore.d/config.d/
There is also /FlashBFS/system/appcore.d/, where there is no config.d folder, which is fine.

The only thing in common_dll.dll is the removed signature checks for the conf.cfc. I think there is a manual method, where you can decrypt conf.cfc, make the necessary modifications, re-calculate the CRC and encrypt it back. The original 2.3.0 automated hack had problems with CRC recalculation, and that is why there was need to patch the common_dll.dll.

The resolution and some of the advanced menu options are in conf.cfc and if you have problems with a patched common_dll.dll (given that you copied it to the correct place), then there is problem with conf.cfc.
« Last Edit: May 25, 2016, 03:54:09 am by 2lps »
 
The following users thanked this post: mct75

Offline mct75

  • Contributor
  • Posts: 49
  • Country: us
Re: Flir E4 Thermal imaging camera teardown
« Reply #7841 on: May 25, 2016, 11:37:25 am »
This makes a lot of sense.  I was definitely working with FlashBFS instead of FlashFS.

Does anyone know what the B stands for?  I get the "flash filesystem" part, but what is the B?

Thank you so much for your help so far, I'm slowly getting the hang of this stuff!   How long until someone ports Linux to the E4?   Now that would be fun!
 

Offline mct75

  • Contributor
  • Posts: 49
  • Country: us
Re: Flir E4 Thermal imaging camera teardown
« Reply #7842 on: May 25, 2016, 09:37:38 pm »
That did it!  I moved the conf.cfc from the camera as it arrived to me (unknown lineage but with a working reshack on 2.3.0) to /FlashFS/system/appcore.d/config.d/

I've still got the limited menu set, but I'm going to look at the ui_control.rsc file some more.  At least it's plain text.  Holy grail for me will be the removal of the flir logo and scale bar when "no measurement" is selected.  The color pallets are nice to have too. 

Can the conf.cfc be decrypted anymore?  I tried ftool.exe and got an error.
 

Offline 2lps

  • Contributor
  • Posts: 28
  • Country: bg
Re: Flir E4 Thermal imaging camera teardown
« Reply #7843 on: May 25, 2016, 10:02:17 pm »
Probably for the menu, you can just apply the menu hack.

The ftool is for the 1.x version of conf.cfc. For 2.x you can use cfccfg_V2: https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg596959/#msg596959 (there is a link to the original post of how to use it - https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg594600/#msg594600)

To get your SUID:
0. Put the camera into RNDIS mode
1. Open the command prompt and telnet to the camera:
telnet 192.168.0.2

You will gain access to the FLIR Command Line Interpreter

2. CD to FlashFS/system/

\>cd FlashFS/system/

3. Execute suid.exe
\FlashFS\system\>suid

The SUID necessary for cfccfg_V2.py will be printed.
 

Offline mct75

  • Contributor
  • Posts: 49
  • Country: us
Re: Flir E4 Thermal imaging camera teardown
« Reply #7844 on: May 26, 2016, 03:25:02 am »
Very cool!  Thank you.   It's nice to see what the conf.cfc actually has in it.    I see that my serial number and a "CRC03" are at the very bottom, then a line of a bunch of gibberish.   The rest of it is very plaintext though.
 

Offline Lazarus4_

  • Contributor
  • Posts: 8
Re: Flir E4 Thermal imaging camera teardown
« Reply #7845 on: May 28, 2016, 11:00:14 am »
Hello.

I applied the Res and Menu hack from 2lps on my E4 @ FW 2.11.0.
Everything worked just fine. The only problem I got is that after the Menuhack
the FLIR imprint on the pictures I take isn´t  visible anymore. Still I would like to have the
logo in every picture I take. Is there any way to make this possible again?

I tried the command "> rset .ui.userSettings.overlayLogo true" via telnet but it shows "bad data" as a result.
Anyone can help me?

THX
 

Offline electr_peter

  • Supporter
  • ****
  • Posts: 930
  • Country: lt
Re: Flir E4 Thermal imaging camera teardown
« Reply #7846 on: May 29, 2016, 10:42:02 pm »
I noticed that E4 camera have frozen 2 times already. Picture froze, buttons did not respond. Holding power key restarted camera. Camera froze at seemingly random times (possible at calibration stage), otherwise 99.9% of time works fine. Device E4+ with 2.11 FW

Question - is there a way to know what caused this issue? Is there a log for failures in internal files?
 

Offline mct75

  • Contributor
  • Posts: 49
  • Country: us
Re: Flir E4 Thermal imaging camera teardown
« Reply #7847 on: May 29, 2016, 11:56:34 pm »
Mine has locked up a few times.  It will either:

  • Pop up a modal box saying appcore.exe had to shut down
  • Go to a solid white screen
  • Sometimes the pixels will go full-scale 'hot', usually creeping from top to bottom

However, my camera is heavily molested so some of that may be my error.
 

Offline electr_peter

  • Supporter
  • ****
  • Posts: 930
  • Country: lt
Re: Flir E4 Thermal imaging camera teardown
« Reply #7848 on: May 30, 2016, 04:32:41 pm »
mct75, symptoms you described does not fit in my case. Camera just froze in operation, still showing last frame with coloured thermal pattern and markers - no extra weird behaviour was noticed.
 

Online Lunasix

  • Regular Contributor
  • *
  • Posts: 128
  • Country: fr
Re: Flir E4 Thermal imaging camera teardown
« Reply #7849 on: June 02, 2016, 07:30:43 am »
Great post !

I have applied the hack with success, and increase in quality is impressive. Thanks.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf