FLIR E4 Wifi Resolution and Menu Hack Thread

[davith]

annnnnnnnnnnnnnnnnnnnnd IT WORKS!
I must have unplugged, uninstalled drivers, reinstalled drivers, rebooted, ect ect 50 times. Got in to be recognized once.  Finally got the the RNDIS permanent option installed using FLIRInstallNet.exe and "Set_RNDIS_permament.fif", from there it was all easy sailing. Didn't have any issues connecting with FTP at any point in the rest of the process. Got the basic package installed by following the straightforward instructions in the pack.

I think I'll leave it like that for a bit. Lots of heartache, frustration, and terror over the past day getting everything broken then more broken then working again. Those Christmas presets look realllly cool though. Thank you so much! See yall in a few days once I get a handle on all the current fun features.

[Bud]

Glad we could help. Enjoy your toy ! 

[Koontzy]

Having some trouble hacking a E4 1.2L non wifi with firmware 3.16
RNDIS working but when I add common_dll and my new conf.cfc with my custom SUID, after rebooting I lost the MSX fonction (well, all the "image mode" setting) and camera look like low res instead of 320x240
Wondering if I should downgrade to 3.12 (that the newest basic package I found) and I've read fews times that downgrading is never a good idea 😅
Also, from what I read I should be carefull using wifi files on a non wifi version, maybe that why I lose MSX fonction and it's not working

edit : well, actually, common_dll is working (but it's the exact same size as the original one) and camera reboot and everything work like a stock one. Then the conf.cfc screw things up and I lose everything that is related to the vision camera. The temperature sensor work great

[Psi]

Be careful to replace files on the camera, don't rename existing files and copy in new ones.
You should be copying files off and saving them externally as your backup, then replace existing files if one already exists.
If you simply rename existing files, to get them out of the way, the cameras can find the old files and get confused. Especially with config files

[Koontzy]

Well, like you probably heard lot of time here already, I was dumb and using SUID instead of serial number in conf.cfg... 
Everything is installed I am at the christmas package 😅

[Syntaximus]

Hello all!

My friend is in need of a thermal imager and he linked me to this forum and asked if I could implement this modification.  It looks like this thread continues from a 300-page thread and I was just wondering...where do I start?  Has anyone written a guide along the way?  About how much learning time would it take for a beginner to start to understand the concepts you're putting to use here?

Thanks a ton and take care!

[Psi]

The guide/instructions are in the zip files you download.
You just need to read the posts carefully to make sure you are downloading the right files for the E4 fw version you have.

If you're doing the hack for someone else, make sure they know that there are no guarantees. You could make a mistake and brick their E4.

And they need to be aware of the limitations, they cannot do an official firmware upgrade on the unit after the hack or it will brick it. To do an official upgrade the hack must be removed and the camera restored to stock first. That is why it's critical to backup everything before replacing files.

[windtalker]

Hi everyone, newbie hobbyist here. I recently got a E4 (e63900 t198547)that won't boot pass the logo screen, that is screen is blank after flir logo. It seems like a hack gone wrong

I am using a windows XP vm, and can connect through FTP to 192.168.0.2 after connect through usb on the first time (anonymous/NcFTP@, flir/3vlig says bad username/password)

after install Flir drivers and flir tools:
upon usb connection: ThermaCAM connect 3" \\IRCAM4007\Images information = 1326 Logon failure: unknown username or bad password
flir tools: import: no sources was found

FLIrInstallNet's :
get versions: Product identification is simply "Qx", OsImgKit 18.1.20, application up status is "DOWN", all the rest is blank (sw combination, appkit,bootloader, confkit, prodkit and serial number)
Check installation: CRC Appkit failed

I have downloaded all files through FTP:
/FlashBFS/system most files were last modified in DEC 2014, with common_dll.dll, bootlogo_legal.bmp rainhc.pal. lava.pal and arctic.pal last modified in OCT 2018
/FlashFS/System/appcore.d/config.d/conf.cfc is last modified in OCT 2018 as well
There is also an thermal image with 320x240 resolution in FlashIFS/DCIM/FLIR_100 with a timestamp of OCT 2018 20 minutes BEFORE last modified timestamp of common_dll.dll and conf.cfc



I have uploaded the entire files directory (zipped) here with timestamp preserved https://drive.google.com/file/d/1wuA9_M5r9ACP5AUs2fRWBD9n1PhAw4vV/view?usp=sharing

I have read through a lot of the posts but I never found a similar situation. Is this one doomed? What other diagnostics process should I try first?

Thank you all !

[Bud]

Replace common_dll on the camera with the attached version and see if the camera boots.

[windtalker]

Yes thank you it booted! however the crosshair is not seen, and when i pressed the trigger to take a picture it says "application appcore.exe encountered a serious error and must shutdown". after that videofeed is still live in the background, but buttons stopped working, except long press to power down. FTPed in, image is not actually saved

thermaCAM connect 3 still report same error "\\IRCAM4007\Images information = 1326 Logon failure: unknown username or bad password"

attached is the error message image

edit: camera information from settings
E4 1.1L
software 2.3.0

[Bud]

Use Telnet to connect to port 23 (can use puTTY program for that or other Telnet client) , login and run this command:

suid

You may need to enter login credentials again if get invalid password message first time.

Post the result.

[windtalker]

\>suid.exe
1151D50200581529

Thank you!

[Bud]

Try replacing the existing conf file with this one ( unzip and put in  FlashFS\system\appcore.d\config.d\   ).

After copying the file, power off the camera, remove the battery for 10 sec, reconnect and power on.

[windtalker]

Thank you Bud!!! Now its taking pictures, i have attached a few down here.
After usb/ftp connection, the msx mode will be stuck on black and white sometimes but a cold reboot will fix it, also attached a pic

I see that the thermal image is already 320x240, thank you again for not only fixing it but also increased the resolution!

For my own curiosity and maybe posterity, i am wondering what went wrong in the first place

I see the common_dll.dll has a version of 1.12.1.0, but the SW version is 2.3.0, is it because someone hacked it in 1.xx and then tried to update the software to 2.3.0? Or was the common_dll.dll and conf.cfc got corrupted during transit?

Not really sure if the system is in a "clean" state, can i use the menu to factory reset the software to a known "clean" state?

Thank you again!!

[Fraser]

Be advised that the E4 always produces a 320x240 pixel image, no matter what the thermal resolution setting. Upscaling is used to achieve this. For actual thermal resolution, look at the saved picture in FLIR Tools on the right hand side information pane. That shows the true thermal resolution.

Fraser

[Bud]

@windtalker
Ok, glad it now is working. Both the dll and conf file were botched. The dll was a fraction of the normal size and the conf file was corrupted. I think the firmware was 2.3.0 and was fine but the owner proceeded with patching and this was when things gone wrong.
We are in a wrong thread actually, v2.3.0 should belong to the other E4 thread, it was the original thread with upgrade procedures for versions equal or earlier than 2.3.0. Upgrade procedure in this thread is for v3.x.x. That threw me off at first as i could not properly decrypt your original conf file until i realized 2.3.0 used different stuff.

Anyways, do you want to stay with what you got or go ahead and unlock extra palletes, measurement tools, PIP and stuff? As it is now resetting to factory state should be fine, i do not think it will affect the res upgrade.

And can you now connect to the picture storage through USB?

[Bud]

For actual thermal resolution, look at the saved picture in FLIR Tools on the right hand side information pane. That shows the true thermal resolution.

Thermal resolution can be checked right on the camera in archive view mode. Click on a picture and in the Properties panel scroll to "IR Image Hight/Width" or something to that extent, cant remember the exact parameter.

[windtalker]

Hi Bud thank you! The USB mode through FLIR tools is still not working. It now shows a splash screen recognizing the E4 but when i click to import from the E4, it still shows sources not found. Also connect to live stream doesnt work and is grayed out.
ThermaCAM connect 3 still showing same error.
I have however downloaded the image through FTP and then load them into FLIR tools, which showed IR resolution to be 320x240 under image information.
Do you think I need to load the "Remove_RNDIS_Permament.fif" in order for USB mode to work?

And yes I'd love to have all the extra unlocked! currently the options showing on device are:
image mode: alignment distance, thermal MSX, Thermal, picture in picture, thermal blending and digital camera
measurement: center spot, hot spot, cold spot and no measurement
color: iron, rainbow, gray, below alarm and above alarm
temp scale: auto, manual

edit: FLIRInstallNet shows Local Area Connection 2 - 192.168.0.2 instead of FLIR E4

check installation failed, "CRC Appkit failed"

get Versions:
product indentification: QX
SW combination: 2.3.0
Appkit 2.1.2
Bootloader 16.1.5.0
Confkit E4 1.1L
OSImgkit 18.1.20
ProdKit: 0

edit 2:
got into the hidden menu from camera information, USB mode is RNDIS, tried to select MSD, UVC, and RDNIS+MSD, non worked, once I click middle button it goes back to the hidden menu home, USB mode is still stuck on RNDIS

[Bud]

You can't change modes through the hidden menu, that feature was disabled in the firmware at some point. You'd need  to run the .fif to turn RNDIS off. You can always put it back on, so go ahead and see if Flir Tools can see the camera.

[windtalker]

Yep, after using the "Remove_RNDIS_Permament.fif", it is in MSD+UVC mdoe, comfirmed with hidden menu and FLIR tools, import and video streaming both working! Thank you!

I guess the next step is to back up everything and proceed with the menu hack?

[Bud]

Yes you can make a backup. I will send some files later today.

[Bud]

Try the attached files. The zip archive names represent paths where the files should go.
Reboot and check the palettes, measurement presets and Settings menu. Hopefully I did not goof anything up (I am assuming you made a backup prior to the change).

[windtalker]

Thank you! I think it worked! Although i see that in /FlashBFS/system/ui.d/ there exists toolbar-config_z3.xml, facet_z3.rcc and design_ui_z3.xml and the included files did not have the trailing _z3 in the name. Should I have renamed the replacement file and overwrite the existing ones?

I also spotted in the MSX mode there is some mismatch on the overlay positions. In the first pic the DELL logo and thermal image and DELL logo is not overlapping, is this normal?
probably normal since the 2 cameras have some distance between them

Thank you again bud! You did wonders!

edit: forgot to mention the programmable button showed up in settings menu as well!
Also forgot to ask, i assume in this state updating to 3.16.0 (current latest) will brick the device? Since I do not have the unhacked common_dll.dll and conf.cfc I dont think I can revert back to factory state

[Bud]

Thank you! I think it worked!

OK, this is one happy ending. These babys are hard to kill, Flir did a good job putting survival measures in place.

Although i see that in /FlashBFS/system/ui.d/ there exists toolbar-config_z3.xml, facet_z3.rcc and design_ui_z3.xml and the included files did not have the trailing _z3 in the name. Should I have renamed the replacement file and overwrite the existing ones?

No, do not touch them, leave them alone.

I also spotted in the MSX mode there is some mismatch on the overlay positions. In the first pic the DELL logo and thermal image and DELL logo is not overlapping, is this normal?
probably normal since the 2 cameras have some distance between them

There should be a setting to adjust alignment distance , i think it is the fat double arrow icon in your last screenshot. It should also be accessible in the Settings menu.

Also forgot to ask, i assume in this state updating to 3.16.0 (current latest) will brick the device? Since I do not have the unhacked common_dll.dll and conf.cfc I dont think I can revert back to factory state

It will certainly brick it. I would stick to 2.3.0. Your hardware is 1.1 and i am not sure if you can upgrade to anything beyond 2.3.0 in the first place. And you will not gain much if anything with 3.16.0, all menus and functions remain the same.

[windtalker]

Yeah alignment distance solved it! Working like a charm

Thank you again Bud!