EEVblog Electronics Community Forum
Products => Thermal Imaging => Topic started by: DaveWB on April 04, 2017, 06:23:09 am
-
Hi all,
I was told because of the hardware change to start a new thread here for the new FLIR Wifi units. I received my Wifi unit and successfully connected via RNDIS. I attempted the 2.3.0 regular E4 hack and received the error in the JPEG. I also had done a full backup before hand which I am attaching here. If anyone would be interested in using TeamViewer to take a peak into the unit or if there is any information anyone needs let me know.
Firmware 3.5.0
edit: files wouldn't attach, so I uploaded them here: https://ufile.io/v878a (https://ufile.io/v878a)
DaveWB
UPDATE: @Bud has done it! See here: Post 1336326 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1336326/#msg1336326)
UPDATE: I have created a new tutorial video here: https://youtu.be/y3_wKq6V6i8 (https://youtu.be/y3_wKq6V6i8)
-
Did you try the 2.11 hack? Can you upload the backup anywhere?
Sent from my ONE A2003 using Tapatalk
-
Yes I just tried the 2.3.0(which came after 2.11.0) hack per the picture above, I just uploaded the backup.
-
The 2.11.0 hack came after 2.3.
-
You are right, that's my bad. However yes it was the 2.11.0 hack.
-
Firmware 3.5.0
I guess no previous hack will work.
how the WIFI works? is the camera accessible over Telnet like USB?
can you stream the camera image (WIFI Camera)?
-
Firmware 3.5.0
I guess no previous hack will work.
how the WIFI works? is the camera accessible over Telnet like USB?
can you stream the camera image (WIFI Camera)?
The wifi isn't that great, the camera can create a wifi network or also join your local network. I can detect the camera created network on my computer but it will never seem to connect. The camera will connect to my home wifi and the FLIR will show up in FLIR Tools with an option to stream but I believe some type of firewall is blocking it from streaming or getting pictures off the camera. I was able to access the files via RNDIS on the camera with the Temporary RNDIS file in FlirInstallNet, however I am unsure of how to use telnet so I cannot answer that question.
-
Firmware 3.5.0
I guess no previous hack will work.
how the WIFI works? is the camera accessible over Telnet like USB?
can you stream the camera image (WIFI Camera)?
The wifi isn't that great, the camera can create a wifi network or also join your local network. I can detect the camera created network on my computer but it will never seem to connect. The camera will connect to my home wifi and the FLIR will show up in FLIR Tools with an option to stream but I believe some type of firewall is blocking it from streaming or getting pictures off the camera. I was able to access the files via RNDIS on the camera with the Temporary RNDIS file in FlirInstallNet, however I am unsure of how to use telnet so I cannot answer that question.
Looking through the files briefly, there is a file called "MaxResolution.txt". It's currently set to 80, however if you change that and then run the hack does it do anything?
-
If the E4 is in RNDIS only, you don’t can stream. But if RNDIS over Wifi has the same functionality, you can use EX-Tools (link in my footer) and connect to it. Then you should be able to change settings and download images. I had a function called "RNDIS Grab Screen". Maybe you can use this to get a image, but that way is slow.
If the Camera is connected you can change the USB Mode to "RNDIS_UVC" maybe the camera can stream after a reconnect.
And the "Maxresolution" can be ignored, on a hacked and working camera it has 80 too. Maybe it's just some Debug output or something else. The Hack work with config.cfc and the common_dll.dll, so changes of these files has to be analyzed.
-
When I was testing it, it was in MSD mode. The stream button was highlighted in FLIR Tools, however it seemed to never do anything after clicking it. I will try EX-Tools later tonight and see if that gets it going.
If you look at my first post the screenshot says that the error occurs at line 80, does this give any relevant information as to what it is getting caught up on?
-
I don't own an E4 but have been reading up on the hack. I have read that the patch to common_dll.dll is to remove a signature check. Does anyone have a copy of the 2.11.0 dll before and after the patch has been applied. Then we can take a look at the common_dll.dll from version 3.5.0 and see if it just needs the offsets tweaked. I believe this was all that was needed to update the hack from 2.3.0 to 2.8.0.
I'm happy to have a peak at it if the files are easy to get.
-
I will get these files on here later tonight when I get home.
-
I don't own an E4 but have been reading up on the hack. I have read that the patch to common_dll.dll is to remove a signature check. Does anyone have a copy of the 2.11.0 dll before and after the patch has been applied. Then we can take a look at the common_dll.dll from version 3.5.0 and see if it just needs the offsets tweaked. I believe this was all that was needed to update the hack from 2.3.0 to 2.8.0.
I'm happy to have a peak at it if the files are easy to get.
Attached are the requested files, I sorted them in different folders to make it a little easier. This is from a 2.11 camera.
-
If I suggest a patch to common_dll.dll and it turns out to be incorrect what are the ramifications? Will it brick the camera? I had a look at the 2.11 regular and patched dll files. There are 2 byte changes. I found similar routines at slightly different offsets(this is to be expected) in the 3.5.0 file. I can attach a patched file but I don't want to brick someone's camera. The best way would be a full disassembly but comparing previously patched files like this often works when patching new versions of previously patched routines.
-
If I suggest a patch to common_dll.dll and it turns out to be incorrect what are the ramifications? Will it brick the camera? I had a look at the 2.11 regular and patched dll files. There are 2 byte changes. I found similar routines at slightly different offsets(this is to be expected) in the 3.5.0 file. I can attach a patched file but I don't want to brick someone's camera. The best way would be a full disassembly but comparing previously patched files like this often works when patching new versions of previously patched routines.
If the wrong common_dll.dll is on there it will just show a screen with no cursor or menu, however the original dll can easily be put back on so no worries about testing this out.
-
OK, here is a patched version of common_dll.dll for version 3.5.0
No warranty, use at your risk - hopefully it's easy to copy the file to the cam.
I assume the other file needs to be updated too but I doubt it has changed.
edit - patched dll removed for now. If there is someone who knows how to package this please let me know.
-
OK, here is a patched version of common_dll.dll for version 3.5.0
No warranty, use at your risk - hopefully it's easy to copy the file to the cam.
I assume the other file needs to be updated too but I doubt it has changed.
The other file that would need to be modified is the conf.cfc, I am not sure how to modify that without using the python script
-
That is beyond what I can do tonight. Hopefully someone else can package it up into the patch script to give it a try. Perhaps I will remove the attachment for now. If there is someone who want to give it a try though I can email it to them. I don't want a bunch of people downloading a useless or bad file.
-
That is beyond what I can do tonight. Hopefully someone else can package it up into the patch script to give it a try. Perhaps I will remove the attachment for now. If there is someone who want to give it a try though I can email it to them. I don't want a bunch of people downloading a useless or bad file.
Attached is the common_dll.dll.delta file that is in the 2.11 hack pack
-
delta file updated for the addresses changed in 3.5.0
-
delta file updated for the addresses changed in 3.5.0
Well the python script is still giving the same exact error as post #1, however I was able to upload the common_dll.dll you uploaded earlier into the camera and the camera seems to be fully functioning, I think the next step is I'm going to try to find out how the conf.cfc is working, edit my .cfc the same way, upload it to the camera and see how that works.
Thanks for your help so far!!
-
Does anyone know what this means? This is where the python script is getting caught up
assert found, "UNKNOWN %s: digest/len is %s" % (name, h)
-
Yep, it failed the SHA256 checksum. updated patch file sent, fingers crossed it all works!
-
Hi,
first for all, great work Guys, i´ve already Hacked a old Flir E4 Years ago.
Now i have a new Flir E4 2.0 L with Software 3.5.0. is it possibly to do the resolution hack and how does it Work?
Thx!
-
Hi,
first for all, great work Guys, i´ve already Hacked a old Flir E4 Years ago.
Now i have a new Flir E4 2.0 L with Software 3.5.0. is it possibly to do the resolution hack and how does it Work?
Thx!
Did you not read anything above?
-
Here is how you can switch between encyrpted/decrypted conf files. You can try to decrypt, modify the resolution and encrypt again. I would try to decrypt it again, to verify it is working as expected.
https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg948898/#msg948898 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg948898/#msg948898)
-
Here is how you can switch between encyrpted/decrypted conf files. You can try to decrypt, modify the resolution and encrypt again. I would try to decrypt it again, to verify it is working as expected.
https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg948898/#msg948898 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg948898/#msg948898)
Thanks 2lps for that, I successfuly decrypted the conf.cfc file by getting the suid. I changed the conf.cfg, and then uses crc03.exe to find the CRC code, was this the correct process? After I added the CRC to the file, re-encrypted with the cfccfg.py, I then lost MSX. I will play around a little more with it later.
The suid for the camera files from the original post is 22C7E4020050281A if anyone wants to play around with the files
-
For the 2.3, 2.11 hacks, if the common_dll.dll was properly patched, you didn't need to recalculate CRC. That was the whole idea of patching it in the first place - to remove the checks.
Missing MSX leads me to believe that the DLL patch is not correct, or there are additional checks. I will try to look at the code when I find some free time.
-
For the 2.3, 2.11 hacks, if the common_dll.dll was properly patched, you didn't need to recalculate CRC. That was the whole idea of patching it in the first place - to remove the checks.
Missing MSX leads me to believe that the DLL patch is not correct, or there are additional checks. I will try to look at the code when I find some free time.
I did have just the modified .dll on there and the camera still worked fine. When you say I don't need to recalculate the CRC, does that mean that any CRC can be used or do I use the original CRC, or just delete the line out?
-
Hello guys,
I'am happy to donate my brand NEW Flir E4 with
Hardware 2.0 Firmware 3.5.0
for testing.
Just PM to me.
-
I did have just the modified .dll on there and the camera still worked fine. When you say I don't need to recalculate the CRC, does that mean that any CRC can be used or do I use the original CRC, or just delete the line out?
Just leave it as it is. I guess, I will need to verify if common_dll.dll was modified correctly. I will try to find some time during the weekend.
...
I believe DaveWB subbed my files in where needed however he still got an error when trying to install it(I believe related to the checksum which is very strange).
...
He needs to be sure that the original file is on the camera before running the python script. If he still has the patched one, the checksum will fail.
-
Yeah, I thought he had put the original back before he tried.
-
I got my new Flir E4 (ordered without Wifi). I thought it would be equipped with FW 2.11. Now i have a Wifi-less device with model Flir 2.0L and Firmware 3.5.0
Is there a known 2.11 download source somewhere, so i could try a downgrade.
regards
Mono
-
Downgrade will NOT work.
It will brick the camera !!! It is because of hardware 2.0. The camera will than be stuck in bootloader mode.
so DO NOT try to downgrade on hardware 2.0.
regards
-
@Xavier64: Thanks for the advice!
Did you got your new E4 with our without WIFI?
-
Yes, already bricked one :-(
-
All cameras until Dec. 2016 are hardware 1.2 with firmware 2.11 .
All cameras from Feb. 2017 are hardware 2.0 with firmware 3.5.0 with or without Wifi.
Thats how it is. Try to get a used, old one to do this hack.
regards
-
A little update:
2lps provided me with a conf.cfc file, the camera has 320x240. However MSX is lost along with the crosshair.
Attached is a photo of the picture I took with the E4 Wifi with the modified conf.cfc file.
-
good job. Do you need any help?!
regards
-
Loss of MSX and the crosshairs was a common symptom amongst earlier E4 upgrade attempts and was an indicator that the upgrade was not configured correctly to be accepted by the camera. I do not recall the details but someone else might. You appear to be on the right path though.
Good Luck :)
Fraser
-
How the 2.3/2.11 hack works:
Regarding E4 with updated firmware:
The new "protection" is based on the fact that the per-device config files (FlashFS\system\appcore.d\config.d\conf.cfc, FlashFS\system\ui.d\config.d\conf.cfc, FlashFS\system\services.d\config.d\conf.cfc) are now encrypted and signed.
The encryption algorithm is RC4 with the key being the SHA1(key || "2A00"), where "key" comes from the "FAD1:" device, ioctl 0x800040C0. That ioctl, which I don't fully understand what it's actually doing, returns 0x18 bytes, with the last 8 bytes being the key (not sure if it's per-device or generic), and the second word indicating whether the config-files have to be globally signed or just including a hash. On my camera (1.2L, came with 2.3.0) it indicated that they have to be signed. common_dll.dll checks for the config file signature, and uses a RSA1024 bit public key to verify the signature.
So far, that's all bad news.
You can patch your config-file, and patch common_dll.dll to disable the signature check (and because I couldn't get CRC03 to compute correctly, I patched that as well), but then the camera doesn't auto-boot anymore since applauncher.exe verifies the CRCs from applaunch.dat (which fails for my patched common_dll.dll), and applaunch.dat itself is signed (applaunch.sig).
BUT: It appears that CRMD160 is very fundamentally broken for byte values >= 0x80 (talk about not compiling with /J, hehheh). This allows to conveniently patch the signature check in a way that applauncher.exe doesn't notice. (Unfortunately the config signature check uses MS Crypto Provider, not their custom stuff.)
...
The common_dll.dll.delta from the hack package contains 2 offsets, which patches the checks for:
1. The signature at the end of the conf.cfc. We don't have the private key, which is used to create it. If you take a look at the cfccfg_V2.py found (https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg596959/#msg596959 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg596959/#msg596959)), you will see something like this:
with open(fileout, "wb") as tmpfile:
tmpfile.write(crypt(contents , key))
tmpfile.write("\x00" * delta)
[b] tmpfile.write("\x00" * 0x80)[/b]
tmpfile.write("".join(tail))
The 128 bytes, where the signature is supposed to be is set to 0 (before that is some padding).
2. The CRC03 check at the end of the conf.cfg
There is a crc03.exe, which can be used to calculate it (https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg403480/#msg403480 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg403480/#msg403480)). The ZIP also cointains the source code. Before running it, the line with the old CRC03 should be removed, and the empty line at the end should remain. While trying to figure out the 3.5 firmware, I verified that it outputs correctly the original CRC03.
I guess the patch for the CRC03 check in common_dll.dll is not needed, if it is re-calculated correctly. Confirmed this with the 2.11 firmware, but removing the second offset patch.
Of course, you first need to decrypt the conf.cfc to conf.cfg (see https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg948898/#msg948898 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg948898/#msg948898)), modify the settings you want, re-calculate the new CRC03 and encrypt it again.
So, patching the 2 locations sounds easy, if it wasn't for the applauncher.exe (found in \Windows, but originally in NK.bin, which is not modifiable. Some info how to extract it can be found here - https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg382279/#msg382279 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg382279/#msg382279)).
If you take a look at \FlashBFS\system\applaunch.dat, you will see this:
# Show intro bootlogo and start progress
progressapp -f \flashbfs\system\bootlogo.bmp -g flashbfs\system\bootlogo_legal.bmp -d1
# Start command shell on the RS-232 port
cmd /R
# Register a default user
defaultusr
# Start appcore. Appcore starts other necessary processes
appcore
# Show intro bootlogo and start progress
progressapp -f \flashbfs\system\bootlogo.bmp -g flashbfs\system\bootlogo_legal.bmp -d
# Start command shell on the RS-232 port
cmd /R
# Register a default user
defaultusr
# Start appcore. Appcore starts other necessary processes
appcore
# doCRC FlashBFS\system\appcore.exe 1821696 171809062
# doCRC FlashBFS\system\common_dll.dll 1225216 3274495904
# doCRC FlashBFS\system\appcore_dll.dll 708608 1774464110
# doCRC FlashBFS\system\progressapp.exe 29184 524537005
# doCRC FlashBFS\system\defaultusr.exe 5120 1813565132
# doCRC FlashBFS\system\chargeapp.exe 32768 1404156161
# doCRC FlashBFS\system\ui.d\design_ui_Z3.xml 36688 375538573
# doCRC FlashBFS\system\ui.d\facet_Z3.rcc 296494 1671048554
# doCRC FlashBFS\system\ui.d\toolbar-config_Z3.xml 1263 2286214514
As you can see, the applauncher.exe will doCRC check for the common_dll.dll (and no, you can't modify the .dat file, as there is a signature file \FlashBFS\system\applaunch.sgn)
So, if there is a CRC check for the common_dll.dll, how was the 2.3 hack developed? If you take a look at the first quote, you will see this:
BUT: It appears that CRMD160 is very fundamentally broken for byte values >= 0x80 (talk about not compiling with /J, hehheh). This allows to conveniently patch the signature check in a way that applauncher.exe doesn't notice. (Unfortunately the config signature check uses MS Crypto Provider, not their custom stuff.)
Not that I understand it fully (except that CRMD160 is the class that implements the RMD160 hash function (https://en.wikipedia.org/wiki/RIPEMD (https://en.wikipedia.org/wiki/RIPEMD)). I guess FLIR have some implementation of it in the applauncher.exe (I disassembled the code and found it). Also the crc03.exe (found in tools1.zip mentioned above) has some reproduction of it.
It appears that a loophole was found, which allowed the patch of common_dll.dll to be undetected. This was important, because this was how the signature check at the end of the conf.cfc was removed. We don't have the private key used to re-create it during encrypting the .cfg (after it was decrypted and modified).
I think if the common_dll.dll modification is detected, the camera will stop on the FLIR logo (but still will be recoverable, but returning the original common_dll.dll).
The image DaveWB posted (https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1181159/#msg1181159 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1181159/#msg1181159)) was taken after uploading a decrypted/encrypted conf.cfc, which is missing the signature at the end. Also, I think it was with the original common_dll.dll. Apparently, if the signature check fails, the MSX and a lot of other features are gone. I guess the camera loads some default settings. Not sure about the 320x240 image. I think DaveWB tried with an 80x60 in the conf.cfc and it was the same.
Now, TheSteve did provide a .diff file. I took a look at it, and I think the signature patch was correct, but the second CRC03 patch was not (it doesn't matter if the CRC03 was properly calculated before encrypting the conf.cfg, but not sure what would be the result of patching the second offset). I created a common_dll.dll equivalent with the one for the 2.11 hack. We are still in the process of experimenting with it, but there was 1-2 times, when the camera stopped at the logo. I am not sure if DaveWB successfully uploaded the patched common_dll.dll as I think we need to execute stopapp via telnet, before ovewriting the common_dll.dll currently on the camera. I thought that it is not necessary, as FileZilla didn't give me any error, but it didn't also replace it successfully. When DaveWB tries to overwrite directly, it gave him some error about no space left.
He will retry the process when he has time and there will be 2 possible outcomes:
1. FLIR didn't add any additional checks and the camera will boot normally.
2. The camera will stop on the FLIR logo, indicating that the loophole for patching the common_dll.dll was closed. (It happened few times, but I am not sure if it was because of mistake by DaveWB, or the patched file was successfully copied at these 2 instances).
There is one thing in the \FlashBFS\system\applaunch.dat in the 3.5.0 firwmare that caught my attention:
# Show intro bootlogo and start progress
progressapp -f \flashbfs\system\bootlogo.bmp -g flashbfs\system\bootlogo_legal.bmp -d1
# Start command shell on the RS-232 port
cmd /R
# Register a default user
defaultusr
# Start appcore. Appcore starts other necessary processes
appcore
# doCRC FlashBFS\system\appcore.exe 2018816 4043546286
# doCRC FlashBFS\system\common_dll.dll 1276928 1802841112
# doCRC FlashBFS\system\appcore_dll.dll 752640 3188104637
# doCRC FlashBFS\system\progressapp.exe 41984 196088817
# doCRC FlashBFS\system\defaultusr.exe 5120 2422935587
# doCRC FlashBFS\system\chargeapp.exe 32768 4243241340
# doCRC FlashBFS\system\ui.d\design_ui_Z3.xml 44574 4226502971
# doCRC FlashBFS\system\ui.d\facet_Z3.rcc 352779 2302427115
# doCRC FlashBFS\system\ui.d\toolbar-config_Z3.xml 1263 2286214514
# doACRC FlashBFS\system\appcore.exe 2018816 4215410483
# doACRC FlashBFS\system\common_dll.dll 1276928 639260284
# doACRC FlashBFS\system\appcore_dll.dll 752640 1574305936
# doACRC FlashBFS\system\progressapp.exe 41984 3268776627
# doACRC FlashBFS\system\defaultusr.exe 5120 3631190782
# doACRC FlashBFS\system\chargeapp.exe 32768 2540764423
# doACRC FlashBFS\system\ui.d\design_ui_Z3.xml 44574 1589578471
# doACRC FlashBFS\system\ui.d\facet_Z3.rcc 352779 246149579
# doACRC FlashBFS\system\ui.d\toolbar-config_Z3.xml 1263 1658689284
The doCRC lines are followed by similar ones, but with the doACRC at the beginning, like this:
# doACRC FlashBFS\system\common_dll.dll 1276928 639260284
What the applauncher.exe does with the doCRC, is find all lines with it and use sscanf to separate the file path, the size, uknown in 3 variables. Then it checks the size, executes the RMD160 code and compares some result with the 3rd value.
I don't have the 3.5.0 update package (neither I could find it on FLIR's site), so can't get the NK.bin for 3.5.0 and dissasemble applauncher.exe to see what exactly doACRC does. If someone knows a way to get it from the camera... I have limited knowledge about embedded device development (WindowsCE even less) or cryptography. I wonder if the code calculates 2 CRC values and somehow closes the loophole, but I can only speculate.
Let's see what will happen when DaveWB successfully uploads the patched common_dll.dll.
-
Flir E4 hardware 2.0 with firmware 3.5.0 backup image complete:
https://mega.nz/#!dN1UkIDD!zEMFz6rvrhuIo0desYyJZIvBeApmcEwPNL22Jr-dqlw
about 145 files were not saved according to TIconfig. Hope it will help.
Best regards
-
Unfortunately, the result of the test was that uploading a patched common_dll.dll, causes the camera to not boot normally as I suggested in my previous post. We tried with just one byte change, which patches the signature verification.
-
@DaveWB,
This is your files which I modify, replacement them by FTP, and see anything change or not.
-
@DaveWB,
This is your files which I modify, replacement them by FTP, and see anything change or not.
With the stock common_dll.dll this camera has all the same symptoms as the other attempts made:
320x240 Thermal image only - no crosshairs showing, no image mode other than straight thermal available(no MSX).
-
There are two possibilities: one is your file has been a mess (older and new); the other is the signature mode has been changed.
BTW, your original files link is gone, Can you post the "clean" files again?
-
Friends something new? Did anyone unlock 3.5.0?
-
@DaveWB,
This is your files which I modify, replacement them by FTP, and see anything change or not.
With the stock common_dll.dll this camera has all the same symptoms as the other attempts made:
320x240 Thermal image only - no crosshairs showing, no image mode other than straight thermal available(no MSX).
Were you able to revert back to the original files? I just got a new FLIR E4 with Wifi and I would like to try this hack. Also can you verify you were able to get 320x240 resolution?
-
Unfortunately, the result of the test was that uploading a patched common_dll.dll, causes the camera to not boot normally as I suggested in my previous post. We tried with just one byte change, which patches the signature verification.
Earlier you said that the patch for the 1st check was correct, But the 2nd one was not. If that is the case can't we just used that patched common_dll.dll and recalculate the crc03 correctly using crc03.exe?
-
If you read https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1181686/#msg1181686, (https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1181686/#msg1181686,) you will see that probably FLIR did change the code for checking the common_dll.dll CRC and now patching it is detected. The 2.3 hack required for it to be patched, as there is a signature at the end of the conf.cfc, which we can't recalculate.
-
I just noticed a new firmware version for Ex on the flir support site:
FLIR Ex (3.9.0) Update Pack
Last Updated: May 9, 2017
... FLIR Ex series cameras (S/N prefix: 639). ...
I don't know if that applies to the wifi model but I assume it does as they don't seem to have a separate download for wifi. My E4 hardware 1.2L (non-wifi) has S/N prefix: 639.
I wish you all luck in improving the wifi model.
-
Good catch, the e4 wifi is 639 as well
Download link for 3.9.0
http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_ex_pn639_v3.9.0__update_pack.zip (http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_ex_pn639_v3.9.0__update_pack.zip)
Reuploaded camera files:
https://ufile.io/v878a (https://ufile.io/v878a)
-
Hi guys,
I teardown and compare between two E4s (E4 WiFi and Older E4),
wish to help some people, as shown below:
(https://farm5.staticflickr.com/4251/34614420821_47fb4567a4_o.jpg)(https://farm5.staticflickr.com/4186/33903579344_d019a1994f_o.jpg)(https://farm5.staticflickr.com/4187/34614421091_42189035f4_o.jpg)(https://farm5.staticflickr.com/4163/34583751462_42060c7928_o.jpg)(https://farm5.staticflickr.com/4190/34614421191_271df99868_o.jpg)(https://farm5.staticflickr.com/4247/34746029465_fabe028d43_o.jpg)(https://farm5.staticflickr.com/4156/34583751602_64016df4d6_o.jpg)(https://farm5.staticflickr.com/4181/34614421501_4eb748056d_o.jpg)(https://farm5.staticflickr.com/4223/34746029755_b4018f9246_o.jpg)(https://farm5.staticflickr.com/4179/34361167220_4a236a56c7_o.jpg)(https://farm5.staticflickr.com/4268/33938968663_4d00f51a86_o.jpg)
-
BOGET,
Thanks for the :-+ detailed pictures
The ASCO was always considered to be a versatile platform that likely had parts not fitted, such as WiFi. Your tear-down has confirmed that belief. The ASCO design was always intended to support Wi-Fi and the Ex chassis even has the location for the Wi-Fi board as you have shown.
You have to wonder whether the Wi-Fi capability was removed from the Ex series at one of the marketing meetings, as either too expensive or 'too capable' for the intended market.
Fraser
-
BOGET,
Thanks for the :-+ detailed pictures
The ASCO was always considered to be a versatile platform that likely had parts not fitted, such as WiFi. Your tear-down has confirmed that belief. The ASCO design was always intended to support Wi-Fi and the Ex chassis even has the location for the Wi-Fi board as you have shown.
You have to wonder whether the Wi-Fi capability was removed from the Ex series at one of the marketing meetings, as either too expensive or 'too capable' for the intended market.
Fraser
Hi Fraser,
I suspect that wireless features doesn't contain Bluetooth, but I didn't teardown that much more detail.
BTW, when you turned the bluetooth section's Boolean function to true at conf.cfc in "ui.d", the WiFi menu will disappear.
Maybe that is signature checksum's problem.
-
@BOGET
thanks for sharing the images
Unfortunately only the third image is visible.
I checked it with Chrome / Safari / Firefox.
Please check your permissions ...
-
That is odd. They were all present this afternoon as I looked at every one. Something has gone SNAP !
Fraser
-
Hi everyone
I have FLIR E4 3.5.0
Please help to make a full backup of the software.
What program to use TeamViewer, maybe TIconfig
-
@BOGET
thanks for sharing the images
Unfortunately only the third image is visible.
I checked it with Chrome / Safari / Firefox.
Please check your permissions ...
I changed place to store photos, if you still can't see that,
here is the link to album: https://www.flickr.com/gp/150854135@N06/55Ps0Q (https://www.flickr.com/gp/150854135@N06/55Ps0Q)
-
Hi guys,
Because the hardware is basically the same, maybe replace manually all files by FTP to others old E4 backup files,
let FW downgrade to 2.3.0(like be cover the others older E4 backup files, and install the 2.3.0 update pack again).
Is there any possible?
-
This was considered way back when the first encrypted firmwares were deployed. IIRC you would need to do a hardware memory chip clone for it to work. Sadly this was not deemed possible with the ASCO computer architecture. There is also the issue of the camera specific calibration files that are essential for the cameras correct operation.
Fraser
-
I made a mistake. I try downgraded firmware to 2.11 and camera (hardware 2.0L) is bricked. On screen is show Flir logo, and not boot. Camera isn't visible in Flir Tools. Only drive named ASCO. It's possible recovery firmware?
-
From similar stories with the standard E4, it sounds like you have killed your camera. IIRC you are just seeing some sort of boot loader and the camera firmware you have loaded is incompatible with your version of the camera. Other owners have had to return the camera to FLIR for repair at a cost of around 400 Euro's.
I have not read or heard of a way to do a fresh firmware install from your current situation. Sorry the news is not better.
I cannot say whether your camera will be repaired under warranty or whether you will be charged.
This is one of the dangers of installing an older firmware onto a new platform. The firmware you loaded is only part of the equation, there are different boot loaders and different hardware revisions to be considered as well. If the boot loader is incompatible with the firmware version, you get a bricked camera with no recovery route.
Fraser
-
I made a mistake. I try downgraded firmware to 2.11 and camera (hardware 2.0L) is bricked. On screen is show Flir logo, and not boot. Camera isn't visible in Flir Tools. Only drive named ASCO. It's possible recovery firmware?
Did your camera run finish the all downgrade process?
If it did, you can try to connect 192.168.0.2 via FTP in default setting (don't login with flir/3vlig), and recover it by your backup files.
Otherwise, sent it back to manufacturer.
-
Did your camera run finish the all downgrade process?
If it did, you can try to connect 192.168.0.2 via FTP in default setting (don't login with flir/3vlig), and recover it by your backup files.
Otherwise, sent it back to manufacturer.
"Update"/Downgrade finish normally, but not boot and not possible connect to device via FTP.
-
I just got my E4 (non wifi) back from repair with the HW 2.0L and FW 3.9.0. If I can help testing in any way, please let me know.
-
how it works
Would a live RAM dump be useful for extracting the private key, and would it be unique per device? It's not impossible.
-
The point of public-private key encryption is that the private key is not needed to be on the device EVER. The device holds the public key, which can be used to verify that whomever wrote a given file had possession of the private key when they signed/encrypted it.
-
My bad, i saw RC4 and got ahead of the next paragraph. Question still stands though.
-
Hello all! Any progress on the hack?
-
You can theoretically hack the new version by resigning the update files with your own private key and then replacing the public key in the device with yours: https://eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg465272/#msg465272
Has anyone tried this?
-
I have not tried that, not sure I would know how to go about it honestly. As always if there is anything I can do to help the cause I still have my E4 Wifi running the original firmware as one uploaded in the first post of this thread.
-
:palm: Please forgive my interruption.
I have looked at MANY of the posts on this thread. And do not see a definitive answer. I want to buy and modify a new E4 which as I understand is now shipping with 3.9.0 firmware. Dropping nearly 1k on a maybe is no option for me. CAN the mods be applied successfully at this time? If so, is there a place where I could download all the files and procedure? Still a work in progress? Perhaps a updated summary post for the layman? :-+
Thanks!
p.s. The work all of you are doing is AWESOME! :clap:
-
The latest non-WiFi and Wi-Fi enabled E4 cameras are not upgradeable at this time, and may never be.
I suggest sourcing an old stock E4 and avoiding the 2017 model. This post from BOGET advises how to tell whether an E4 is the pre 2017 model.... the serial number length is different.
https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg1239478/#msg1239478 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg1239478/#msg1239478)
Fraser
-
If that's the case, then we may have to resort to hardware mods. They can do a lot of things that software mods can't do. Of course, that's probably more trouble than it's worth for most people.
Well, you could always resort to social engineering and try to get someone to leak the keys for signing the firmware. :P
-
Hardware mods on the E4 ...... an interesting concept but the high level of integration in modern electronics and specifically these cameras begins to limit what you can do in terms of hardware modes.
The Microbolometer ROIC outputs raw thermal scene information so is pretty ugly to say the least. The main image processing and formatting takes place inside a silicon 'lump' so no hardware modding advisable there. The Silicon 'lump' also contains the firmware. There is no nice and convenient configuration EEPROM to edit or exploit and no exposed core data bus to intercept and manipulate.
It would be interesting to know where a hardware hacker considers the E4 vulnerable to hardware attack and manipulation, short of creating a whole new processor block and firmware for the platform. That, I would suggest, is far more effort than it is worth. Older models of E4, that are vulnerable to firmware manipulation, appear regularly on the secondary market.
Fraser
-
I guess I'll wait and see. :popcorn:
For now, it's a no-go. :=\
-
You can theoretically hack the new version by resigning the update files with your own private key and then replacing the public key in the device with yours: https://eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg465272/#msg465272
Has anyone tried this?
With the older firmware there was no motivation to try that because digital signature check was disabled altogether. It is probably going to take a new generation of,well, enthusiasts to work on that.
There were tools to access and browse the E4 Registry, but no changes to it could be made permanent. So one would probably need to start from understanding how to alter Win embedded Registry, and if it is possible to alter the public key.
-
WayneD,
If you really want a decent thermal camera, do not wait too long. If the latest release of E4 proves too difficult to upgrade, all old stock of the model will be sought out and purchased by those who wish to upgrade the unit. Then the secondary market will see a significant increase in used unit prices.
Regarding the future of the E4 upgrade development..... when it was first discovered that the E4 operating system was relatively open to modification, some clever people worked out how to make configuration changes and calculate CRC's. Whilst FLIR did respond by making the process harder, there was enough motivation in the user community to develop ways around any upgrade protection.
I am not sure that there is the same level of interest in developing an upgrade for the latest version of the E4. There are many E4's that can be upgraded still available and the latest FLIR countermeasure may be a significant challenge to circumvent. Without significant community interest, it may prove to be the first version of E4 firmware hat remains secure against upgrade.
FLIR lan from the E4 upgrade gate they needed to better secure their firmware afpgainst such. Thus is no surprise and they are more than capable of buying in advice on how such my be best accomplished. A public Privat key encryption was always a possibility and was feared by those of us interested in the upgrade of the E4.
Good luck to anyone trying to upgrade a 2017 model E4, I think ounwill neeed it. I still ecommend hunting down any residual ore 2017 stock. Her we many companies that held stock rather than buying in from FLIR when an order was received. If you want an E4, contact some companies and ask if they hold stock, then all for the serial number of a camera to see if it is a pre or post 2017 release. Ensue our order a unit according to its serial number to avoid disappointment.
Good Luck
Fraser
-
I think another reason is the limited demand for an upgrade. Phones and tablets are rooted because mobile devices are ubiquitous these days. Thermal cameras, although becoming increasingly common, are still a niche market.
-
When the E4 first came out in 2013, and it was discovered that it could be upgraded relatively easily, there were a large number of people who wanted one. That pool of people in the market for such a camera has likely bought one by now. There will likely be far fewer interested in developing new approaches to circumvent FLIR's protection after so many years of easy upgradability.
Fraser
-
It only takes one really determined person to push a project like this forward. That person just hasn't appeared yet for the E4 Wifi.
-
DaveWB could you share your modified conf.cfc file
-
Hello Dave and everyone. Im Dan, a building contractor from London. I've fallen in love with thermal imaging and the value it will add to my profession and have started looking for a camera.
Very quickly this led me to the FLIR E4 and of course the hack to E8 performance. However I am concerned that the latest versions of the camera being sold are causing issues for the upgrade hacks. I really would prefer to buy a new unit if its possible to hack rather than get something second hand that is hacked.
If I buy a new E4 with FLIRS latest software will I be able to hack it? Would anyone be able to help guide me through the process when I get it?
I assume hacking the unit voids any warranty?
Thanks
Dan
-
Dan,
The latest (2017 release) FLIR E4 has yet to be hacked. This thread details the story so far.
Hacking has the potential to void the warranty depending upon the nature of any fault that occurs.
There is nothing wrong with a well cared for used E4. They are well built and long lived.
Fraser
-
Fraser,
Thanks very much for your reply. I really appreciate you taking time to respond to me.
Yes they do seem to be very rugged by all accounts. I'll keep an eye on the forum - seems there are some real tech savvy guys here in white coats looking at battling FLIR's software!
Regards from sunny/rainy/windy and anything else if you wait a few minutes UK
Dan
-
Please upload some pictures to prove this.
As far as we all know, downgrade with HW2.0 is NOT possible. But I am very happy to see I am wrong :-)
-
I made a mistake!!
My model is 1,2L
FW 3.5.0
Mars 2017
This is not the model 2L
Sorry
:palm:
-
I've been trying to better understand cfccfg.py and cfccfg_V2.py. I'm having difficulty decoding the conf.cfc file into a conf.cfg file, even when using what I believe to be the correct SUID value. As a check, I tried to decode the conf.cfc file from DaveWB's "Stock Camera" zip file, using the SUID value that DaveWB mentioned (22C7E4020050281A), and I get non-ASCII output in the conf.cfg file. Specifically:
% python cfccfg.py 22C7E4020050281A conf.cfc conf.cfg1
% python cfccfg_V2.py 22C7E4020050281A conf.cfc conf.cfg2
% sha1sum conf.*
cc151985fdc0177f125e8420ced6df4a549ac021 conf.cfc
e3a3b0a4e89b6429cc2618ecb3581ab40230da79 conf.cfg1
3b59eb9f3fc0176acd6a652212a1ab1fcc06f359 conf.cfg2
% strings -n10 conf.cfg*
&YNbM(|(M:
&YNbM(|(M:
The conf.cfc file's SHA1 sum I believe corresponds to DaveWB's "Stock Camera" file, and the "strings" command shows that there's nothing remotely resembling the cfg file ASCII contents in the resulting output. The differences in SHA1 sum of conf.cfg1 vs conf.cfg2 are because cfccfg_V2.py strips off the tail; the decoded contents up to the tail are identical (and non-ASCII).
What's super puzzling to me is that DaveWB reports that he got his file decoded using cfccfg, using the same SUID that I'm trying to use on his same file...
Any thoughts on what might be going wrong here? DaveWB, any chance you remember what command you ran, on what file, and what cfg file did you get out of it?
-
Sorry to ask this but does anyone have the hack for 2.11 with 1.2L hardware the links I found don't work anymore. Thanks :-+ :-+ :-+
-
@DaveWB,
This is your files which I modify, replacement them by FTP, and see anything change or not.
OK so if that post included the modified conf.cfc file then the file was screwed. It has bunch of "ture" instead of "true" modifiers ^-^ . I have attached the decoded file, you guys need to fix the typos, re-encrypt with your SUID and try. Dunno if this will help with the progress but the file needs to be corrected anyways. There was a possibility that the camera aborted reading the cfc file when encountered the error and reverted to the default config. I do not have a wi-fi camera so someone needs to pick it up from here. :popcorn:
-
Sorry about this double Post from the teardown thread but just in case anyone is interested here.....
I have made a decision...... shock, horror, I am going to sell a thermal camera rather than buy one ;D
I will be advertising my used, spare E4 in the For Sale area of this forum later today. It is running its original 1.19 firmware (the best version in my opinion) so it has the nice service menu and easy reconfiguration needing only FileZilla and the CRC01 calculator provided in this thread. It is so easy to enable and disable features on this firmware.
My unit has already been upgrade by me to the E8+ spec and it has the extra menus as well :) Fully operational with battery, charger, USB lead, hard case and original documents.
If you are interested, you can PM me or wait to see the advert and pictures later. I am still considering how much to ask for it and welcome offers. If I like the offer, it will not even get to the for sale area ! This is NOT a silent auction though ! I will be fair to all.
Fraser
Milton Keynes UK
-
SOLD
My upgraded E4 is up for sale now.......
https://www.eevblog.com/forum/buysellwanted/fs-flir-e4-thermal-camera-fw1-19-upgraded-to-e8-from-fraser-the-thermal-nut- (https://www.eevblog.com/forum/buysellwanted/fs-flir-e4-thermal-camera-fw1-19-upgraded-to-e8-from-fraser-the-thermal-nut-)!/
Fraser
-
There are two possibilities: one is your file has been a mess (older and new); the other is the signature mode has been changed.
You were spot on, the modified conf.cfc was bad, see my previous post.
-
These two statements seem to be contradictory:
I did have just the modified .dll on there and the camera still worked fine.
Unfortunately, the result of the test was that uploading a patched common_dll.dll, causes the camera to not boot normally as I suggested in my previous post.
So perhaps another controlled test is needed. Both people seem to have left the thread though.
-
I would be more than happy to use TeamViewer to help out anyone solving this dilemma, unfortunately I do not recall much about what processes I did. I do also have a brand new flir e4 that hasn't been messed with that maybe we can test on as well. The unit is not wi-fi version but is still the most recent version.
-
OK, good to have you back.
Not sure what modified conf.cfc you used, there may be a chance it was a bad one that had typos in it, see my previous posts. If you can provide the test camera SUID and a copy of the original conf.cfc I could help with properly modified and re-encrypted conf file. Both the SUID and conf file must be from a same camera.
So that will have one piece solved. The other piece of course is the patched common_dll.dll file. Do you have a copy patched for both signature and CRC? I think just the signature patch alone may not do it. We may need someone to help validate if the file was patched correctly. I am not sure if just replicating the patched values from the 2.3.0 time would do it. The farther of the original patch wrote back then:
BUT: It appears that CRMD160 is very fundamentally broken for byte values >= 0x80... This allows to conveniently patch the signature check in a way that applauncher.exe doesn't notice.
So what exactly was the "way" the patch was done that applauncher did not notice? Mind that the new common_dll is twice as smaller as the old one in size.
-
Do you think it would be best to use the brand new camera I have to reattempt this? That way we know everything is original?
-
It is only two files at this time, so your old camera should do it unless you screwed it badly.
-
I know I was having issues getting the right .dll on there which I think might have led to some of the problems. I'll check my files and see what I have.
-
I don't have the 3.5.0 update package (neither I could find it on FLIR's site), so can't get the NK.bin for 3.5.0 and dissasemble applauncher.exe to see what exactly doACRC does. If someone knows a way to get it from the camera... I have limited knowledge about embedded device development (WindowsCE even less) or cryptography. I wonder if the code calculates 2 CRC values and somehow closes the loophole, but I can only speculate.
@2lps: if you are still here - here is applauncher.exe extracted from nk.bin from v3.9.0
Or may be someone else could help with disassembling the doACRC routine to see what it does. This is beyond my capabilities and knowledge.
EDIT: I now feel comfortable to retract the last statement. ::)
-
Here is how you can switch between encyrpted/decrypted conf files. You can try to decrypt, modify the resolution and encrypt again. I would try to decrypt it again, to verify it is working as expected.
https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg948898/#msg948898 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg948898/#msg948898)
Thanks 2lps for that, I successfuly decrypted the conf.cfc file by getting the suid. I changed the conf.cfg, and then uses crc03.exe to find the CRC code, was this the correct process? After I added the CRC to the file, re-encrypted with the cfccfg.py, I then lost MSX. I will play around a little more with it later.
The suid for the camera files from the original post is 22C7E4020050281A if anyone wants to play around with the files
This is still the suid when I just ran the same command. I actually haven't messed with the cam in awhile and didn't have menu features. I looked and saw the .cfc was 6436 instead of the 6608 bytes. Anyways, attached is my original backup of the unit which includes the original conf.cfc and common_dll.dll, Both of which I just applied to the camera which brought the all the stock menu functions back.
Link for backup:https://drive.google.com/file/d/0Bze3DIT8O9h0bzJYVTlIRngzcHM/view?usp=sharing]
[url]https://drive.google.com/file/d/0Bze3DIT8O9h0bzJYVTlIRngzcHM/view?usp=sharing (http://[url)[/url]
-
Here is some yummy stuff : a copy of the Registry extracted from nk.bin v3.9.0
Of a particular interest are couple sections :
[HKEY_LOCAL_MACHINE\init]
"Depend110"=hex:64,00
"Launch110"="autoloadcheck.exe"
"Depend111"=hex:64,00
"Launch111"="timeprint.exe"
"Depend97"=hex:1e,00,3c,00
"Launch97"="timeprint.exe"
"Depend25"=hex:14,00
"Launch25"="timeprint.exe"
"Launch03"="timeprint.exe"
"Depend100"=hex:1e,00,3c,00
"Launch100"="applauncher.exe"
"Depend60"=hex:14,00
"Launch60"="servicesStart.exe"
"Depend30"=hex:14,00
"Launch30"="gwes.dll"
"Launch20"="device.dll"
Gives the sequence of loading of the binaries during autostart. And the other:
[HKEY_LOCAL_MACHINE\SOFTWARE\FLIR Systems\Applauncher]
"LaunchFileAlt"="\\FlashBFS\\system\\applaunch.dat"
"LaunchFile"="\\FlashFS\\system\\applaunch.dat"
specifies the startup configuration file .
Yeah baby now we are talking... You software guru out there please tell if it is possible to tweak the Registry and repackage the nk.bin ? It seems only have a crc as the integrity check.
Applaunch.dat is the startup configuration file where also CRC checks are performed on critical application files. Altering applaunch.dat may not be the way to bypass it though, because the file itself is still signed. If we substitute it for a different dat file that new file has no signature, so most likely the boot process will fail. But perhaps the Init section above may give a clue where to look to patch that signature check.
Calling for coding experts and standing by :popcorn:
-
Here is some code from applauncher.exe, which deals with doing the CRC verification. It appears that I was right about doACRC in this post: https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1181686/#msg1181686 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1181686/#msg1181686)
applauncher.dat
# doCRC FlashBFS\system\common_dll.dll 1276928 1802841112
....
# doACRC FlashBFS\system\common_dll.dll 1276928 639260284
signed int __fastcall sub_11B68(const wchar_t *a1)
{
const wchar_t *v1; // r4@1
signed int v2; // r9@1
signed int v3; // r5@1
DWORD v4; // r0@1
size_t v5; // r6@1
void *v6; // r7@3
FILE *v7; // r0@5
FILE *v8; // r8@5
const char *v9; // r6@9
char *v10; // r0@10
DWORD v11; // r4@12
int v12; // r0@13
const char *v13; // r6@18
char *v14; // r0@19
DWORD v15; // r4@21
int v16; // r0@22
size_t v18; // [sp+4h] [bp-34Ch]@7
int v19; // [sp+8h] [bp-348h]@11
char v20; // [sp+Ch] [bp-344h]@21
char v21; // [sp+14h] [bp-33Ch]@12
char v22; // [sp+30h] [bp-320h]@11
WCHAR Buffer; // [sp+130h] [bp-220h]@12
int v24; // [sp+330h] [bp-20h]@1
v1 = a1;
v24 = dword_161A0;
v2 = 0;
v3 = 0;
v4 = sub_1181C(a1);
v5 = v4;
if ( !v4 )
goto LABEL_2;
v6 = operator new(v4 + 1);
if ( !v6 )
{
sub_14994(v24);
return 3;
}
*(_BYTE *)v6 = 0;
v7 = wfopen(v1, L"rb");
v8 = v7;
if ( !v7 )
{
NKDbgPrintfW(L"verifyCRC - cannot open %s\r\n", v1);
LABEL_2:
sub_14994(v24);
return 1;
}
v18 = fread(v6, 1u, v5, v7);
if ( v18 != v5 )
v3 = 4;
fclose(v8);
v9 = (const char *)v6;
while ( !v3 )
{
v10 = strstr(v9, "# doCRC ");
if ( !v10 )
break;
v9 = v10 + 1;
if ( sscanf(v10, "# doCRC %s %u %u", &v22, &v18, &v19) == 3 )
{
wsprintfW(&Buffer, L"%S", &v22);
v11 = sub_1181C(&Buffer);
sub_14250((int)&v21, 1);
if ( v18 == v11 )
{
sub_125BC((int)&v21, &v22);
v12 = sub_142B4((int)&v21, (int)&v18, 4u);
if ( v12 != v19 )
{
NKDbgPrintfW(L"%S [CRC]\r\n", &v22);
v3 = 5;
}
}
else
{
NKDbgPrintfW(L"%S [size]\r\n", &v22);
v3 = 6;
}
sub_12978(&v21);
}
}
v13 = (const char *)v6;
if ( v3 )
goto LABEL_33;
do
{
v14 = strstr(v13, "# doACRC ");
if ( !v14 )
break;
v2 = 1;
v13 = v14 + 1;
if ( sscanf(v14, "# doACRC %s %u %u", &v22, &v18, &v19) == 3 )
{
wsprintfW(&Buffer, L"%S", &v22);
v15 = sub_1181C(&Buffer);
sub_12898((int)&v20, 0x4C11DB7);
if ( v18 == v15 )
{
sub_125BC((int)&v20, &v22);
v16 = sub_12844((int)&v20, &v18, 4);
if ( v16 != v19 )
{
NKDbgPrintfW(L"%S [CRC]\r\n", &v22);
v3 = 5;
}
}
else
{
NKDbgPrintfW(L"%S [size]\r\n", &v22);
v3 = 6;
}
sub_127AC(&v20);
}
}
while ( !v3 );
if ( !v2 )
LABEL_33:
v3 = 7;
operator delete(v6);
sub_14994(v24);
return v3;
}
Here are the functions 2 calls up the stack, where you can see when the integrity check is enforced:
v18 = CreateFileW(L"FAD1:", 0, 0, 0, 3u, 0x80u, 0);
if ( DeviceIoControl(v18, 0x800040C0, 0, 0, &OutBuf, 0x18u, 0, 0) )
{
if ( v35 )
{
// This is one liner, calling sub_11B68, where the CRC check is done.
v4 = sub_11E1C(v15);
NKDbgPrintfW(L"Integrity: %d\r\n", v4);
}
else
{
NKDbgPrintfW(L"No integrity check necessary\r\n");
}
}
BOOL __fastcall sub_11E1C(wchar_t *a1)
{
wchar_t *v1; // r4@1
v1 = a1;
return sub_11880(a1) && !sub_11B68(v1);
}
signed int __fastcall sub_11E5C(signed int a1, int a2)
{
int v2; // r5@1
signed int v3; // r6@1
BOOL v4; // r7@1
bool v5; // zf@2
signed int v6; // r3@5
int v7; // r0@7
int v8; // r4@7
int v9; // r8@7
int v10; // r3@10
signed int v12; // r5@16
const char *v13; // r0@21
const wchar_t *v14; // r1@30
wchar_t *v15; // r6@34
FILE *v16; // r0@34
const char *v17; // r0@37
HANDLE v18; // r4@41
DWORD v19; // r0@45
HDC v20; // r4@51
FILE *v21; // r6@56
int v22; // r4@57
int v23; // r7@57
int v24; // [sp+18h] [bp-A70h]@1
HKEY hKey; // [sp+1Ch] [bp-A6Ch]@1
DWORD cbData; // [sp+20h] [bp-A68h]@3
int v27; // [sp+24h] [bp-A64h]@7
DWORD dw; // [sp+28h] [bp-A60h]@1
DWORD Type; // [sp+2Ch] [bp-A5Ch]@22
CHAR v30[4]; // [sp+30h] [bp-A58h]@51
struct _PROCESS_INFORMATION v31; // [sp+34h] [bp-A54h]@49
HANDLE hObjects; // [sp+44h] [bp-A44h]@49
HANDLE v33; // [sp+48h] [bp-A40h]@51
char OutBuf; // [sp+4Ch] [bp-A3Ch]@41
int v35; // [sp+50h] [bp-A38h]@42
wchar_t pszImageName; // [sp+64h] [bp-A24h]@57
wchar_t Data[1024]; // [sp+264h] [bp-824h]@17
int v38; // [sp+A64h] [bp-24h]@1
v2 = a2;
v3 = a1;
v38 = dword_161A0;
hKey = 0;
v4 = 1;
dw = 0;
if ( !KernelIoControl(16850952, 0, 0, &v24) )
goto LABEL_76;
v5 = v24 == 1;
if ( v24 == 1 )
v5 = cbData == 4;
if ( v5 )
v6 = 1;
else
LABEL_76:
v6 = 0;
v24 = v6;
v7 = KernelIoControl(16850988, 0, 0, &v27);
v8 = v24;
v9 = v7;
v10 = v7 && v27 && !v24;
v27 = v10;
if ( v3 < 2 )
{
printf("Usage: applauncher [options]\n-f <filename> Execute commands in file <filename>\n-r Execute file specified by registry setting.\n(number) Automatic mode (OS internal).\n");
sub_14994(v38);
return 1;
}
if ( v3 != 2 )
{
if ( v3 != 3 || wcscmp(L"-f", *(const wchar_t **)(v2 + 4)) )
{
v13 = "Bad Argument(s)! Use \"applauncher\" for help.\n";
goto LABEL_72;
}
v14 = *(const wchar_t **)(v2 + 8);
v12 = 0;
wcscpy(Data, v14);
goto LABEL_31;
}
if ( !wcscmp(L"-r", *(const wchar_t **)(v2 + 4)) )
{
v12 = 0;
}
else
{
swscanf(*(const wchar_t **)(v2 + 4), L"%[0-9]", &Data[512]);
if ( wcscmp(&Data[512], *(const wchar_t **)(v2 + 4)) )
{
v13 = "Bad Argument! Use \"applauncher\" for help.\n";
goto LABEL_72;
}
swscanf(*(const wchar_t **)(v2 + 4), L"%d", &dw);
v12 = 1;
}
if ( !RegOpenKeyExW(HKEY_LOCAL_MACHINE, L"SOFTWARE\\FLIR Systems\\Applauncher", 0, 0, &hKey) )
{
cbData = 510;
if ( RegQueryValueExW(hKey, L"LaunchFile", 0, &Type, (LPBYTE)Data, &cbData) )
goto LABEL_39;
if ( Type != 1 )
goto LABEL_39;
cbData = 510;
if ( RegQueryValueExW(hKey, L"LaunchFileAlt", 0, &Type, (LPBYTE)&Data[256], &cbData) || Type != 1 )
goto LABEL_39;
RegCloseKey(hKey);
v8 = v24;
LABEL_31:
if ( v12 )
{
Sleep(0x64u);
v8 = v24;
}
if ( v8 )
goto LABEL_77;
v15 = Data;
v16 = wfopen(Data, L"r");
if ( !v16 )
{
v15 = &Data[256];
v16 = wfopen(&Data[256], L"r");
if ( !v16 )
{
if ( !v12 )
{
v17 = "Failed to open the launch specification file. Aborting!\n";
LABEL_38:
printf(v17);
LABEL_39:
RegCloseKey(hKey);
goto LABEL_73;
}
goto LABEL_40;
}
}
fclose(v16);
v18 = CreateFileW(L"FAD1:", 0, 0, 0, 3u, 0x80u, 0);
if ( DeviceIoControl(v18, 0x800040C0, 0, 0, &OutBuf, 0x18u, 0, 0) )
{
if ( v35 )
{
v4 = sub_11E1C(v15);
NKDbgPrintfW(L"Integrity: %d\r\n", v4);
}
else
{
NKDbgPrintfW(L"No integrity check necessary\r\n");
}
}
else
{
v19 = GetLastError();
NKDbgPrintfW(L"FAD call fails:%d hndl:%d err:%d\r\n", 0, v18, v19);
}
CloseHandle(v18);
if ( v24 )
goto LABEL_77;
if ( !v9 )
goto LABEL_78;
if ( !v4 )
goto LABEL_54;
NKDbgPrintfW(L"APPLAUNCHER: Starting usb charge App \r\n");
hObjects = CreateEventW(0, 0, 0, L"ChargeAppFinished");
if ( CreateProcessW(L"ChargeApp.exe", 0, 0, 0, 0, 0, 0, 0, 0, &v31) && v27 )
{
*(_DWORD *)v30 = 2;
v20 = CreateDCW(0, 0, 0, 0);
CreateProcessW(L"cmd.exe", L"/R", 0, 0, 0, 0, 0, 0, 0, &v31);
v33 = v31.hProcess;
WaitForMultipleObjects(2u, &hObjects, 0, 0xFFFFFFFF);
NKDbgPrintfW(L"APPLAUNCHER: Usb charging finished\r\n");
ExtEscape(v20, 100037, 4, v30, 0, 0);
}
CloseHandle(v31.hProcess);
CloseHandle(v31.hThread);
if ( v24 )
{
LABEL_77:
CreateProcessW(L"cmd.exe", L"/R", 0, 0, 0, 0, 0, 0, 0, &v31);
}
else
{
LABEL_78:
if ( !v4 )
{
LABEL_54:
if ( !v12 )
{
v17 = "APPLAUNCHER: Refuses to run launch specification file. Aborting!\r\n";
goto LABEL_38;
}
LABEL_40:
SignalStarted(dw);
goto LABEL_39;
}
v21 = wfopen(v15, L"r");
while ( !feof(v21) )
{
fwscanf(v21, L"%[\t\v\n\r\f]", &pszImageName);
v22 = fwscanf(v21, L"%[^ #\t\v\n\r\f]", &pszImageName);
v23 = fwscanf(v21, L"%[^#\t\v\n\r\f]", &Data[768]);
if ( v22 > 0 && wcslen(&pszImageName) >= 1 )
{
if ( !v27 || wcsicmp(&pszImageName, L"cmd") )
{
if ( v23 <= 0 )
CreateProcessW(&pszImageName, 0, 0, 0, 0, 0, 0, 0, 0, &v31);
else
CreateProcessW(&pszImageName, &Data[768], 0, 0, 0, 0, 0, 0, 0, &v31);
continue;
}
NKDbgPrintfW(L"APPLAUNCHER: Not starting duplicate cmd.exe \r\n");
}
fwscanf(v21, L"%[^\t\v\n\r\f]", &pszImageName);
}
}
if ( v12 )
SignalStarted(dw);
goto LABEL_73;
}
if ( !v12 )
{
v13 = "Failed to open registry settings. Aborting!\n";
LABEL_72:
printf(v13);
}
LABEL_73:
sub_14994(v38);
return 0;
}
Basically it is doing the old CRC verification (first checks the file size) and then another verification, which appears to be a CRC32, based on this:
sub_12898((int)&v20, 0x4C11DB7);
A quick check with Google for 0x04C11DB7 shows that it is the Normal Polynomial representation for CRC-32 (https://en.wikipedia.org/wiki/Cyclic_redundancy_check (https://en.wikipedia.org/wiki/Cyclic_redundancy_check)).
So in order for the old hack method to work, either the common_dll.dll patch should be made in such a way that it is not detected by both CRC checks (although both have weak points, not sure how easy it is to circumvent both at the same time), or the applauncher.dat is modified to remove the doACRC lines (if can be modified, we could have removed the old doCRC, so I guess this is not an easy option)
I don't have much knowledge and time for this, so this is the best I can do to help.
-
I got a 2.0L 3.9.0 with WIFI and I am also curious about this.
-
Hardware 1.2L seems too early for FW 3.9 from the factory. It suggests maybe the camera had a firmware upgrade at some point in time. In the past, cameras that were upgraded with newer firmware were able to be returned to an older firmware as other countermeasures were not present in their file system. Without knowing the firmware that was originally installed in the HW1.2L camera when it was manufactured, it is hard to know which firmware it could be reverted to.
As has been stated in previous comments on this forum. If an attempt is made to revert the 2017 model E4 to an earlier firmware, it gets bricked ! There appears to be an incompatability between the 2017 bootloader or other software, and earlier firmware versions. A bricked E4 needs to be repaired by FLIR at a cost of approx 400 Euros.
Be careful trying to revert to earlier firmware, it can all go terribly wrong with no path back to where you started. Firmware reflashing is a very risky process, especially between hardware revisions.
Fraser
-
Here is some code from applauncher.exe,
Thanks 2lps. I left you a personal message - can you pls check.
-
Not that I understand it fully (except that CRMD160 is the class that implements the RMD160 hash function (https://en.wikipedia.org/wiki/RIPEMD (https://en.wikipedia.org/wiki/RIPEMD)). I guess FLIR have some implementation of it in the applauncher.exe (I disassembled the code and found it). Also the crc03.exe (found in tools1.zip mentioned above) has some reproduction of it.
@lps Are you capable of lifting that CRMD160 code from applauncher and compile an executable for experimenting (file name in, crc value out) , or just the related code listing so someone else perhaps can help compile into an executable? I tried different ways but I was unsuccessful to reproduce the crc values from applaunch.dat. The CRC03.exe produces a different value.
I only need the stuff for the "#do CRC" part of it. For the second part "#do ACRC" I found a software to generate the same values as in the applaunch.dat
-
Pwned !!!
v3.5.0 is now history :box:
There is first successfully updated camera out there. Someone may post pictures soon. :popcorn:
-
Pwned !!!
v3.5.0 is now history :box:
There is first successfully updated camera out there. Someone may post pictures soon. :popcorn:
Great news! I can start keeping an eye out for a new version for cheap then!
Well done all!
-
Does the new approach permit the addition of the extended menu's as well as the upgrade of the resolution ? I can certainly recommend the added menu's that provide some very useful functionality in the E8+ configuration.
Fraser
-
Do not know yet about extending the menu, i do not have a 2017 camera to work with. The res work was done in blind mode with test information sent to an other person who had one.
-
Based on your earlier post you downgraded from 3.5.0 to 2.3.0. You are not running 3.5.0 firmware.
-
Downgrade will NOT work.
It will brick the camera !!! It is because of hardware 2.0. The camera will than be stuck in bootloader mode.
so DO NOT try to downgrade on hardware 2.0.
regards
Pwned !!!
v3.5.0 is now history :box:
There is first successfully updated camera out there. Someone may post pictures soon. :popcorn:
Ooh! is that real?
Sorry that I have a little doubts.
Are you sure that you can actually downgrade the FW 3.x 2.0L to 2.x 1.2L ?
-
No i am not sure, because this is not what iam doing. I am not downgrading the fw version, i am working with the 3.5.0 itself.
-
Hi,
So you mean that your camera FW version is original 3.5.0 2.0L,
and the Res has been succeeded hack, right? :clap:
-
Hello Bud
you can confirm the hack fw 3.5.0
with a picture !!!
-
I'm trying to hack wifi version via eeprom at service menu, but the password is not 1235 anymore.
-
BOGET,
Just as well.... you really do not want to mess with that EEPROMS contents. It has not previously needed any changes as it does not enable hacking, just unit serial number and model details. Messing with its contents can seriously effect your cameras health !
Fraser
-
It ain't that bad,
If you can modify the camera part number to E8,
you might be able to upgrade it's resolution to E8 in normal way by using(deceive) flir tools,
you don't even to hack it.
-
Note normal firmware upgrades do not modify the key configuration files so FLIRTools would not upgrade the configuration files for you. The configuration files would hold the camera at E4 resolution.
Previous, very knowledgeable, hackers of the camera have warned against messing around with the contents of the EEPROM. They had concerns, though I know not what they are.
Fraser
-
I think I did a little better and went after v3.9.0 ::)
I am still working on it but a proof of concept is attached. The 2017 version has joined the club :-+
Those who want to give themselves a nice Christmas present may want to go and grab the 3.9.0 update pack (a link was posted somewhere in this or E4 teardown thread) in case it gets pulled from the Net.
-
Excellent work :-+
Fraser
-
Very nice! :-+
-
I gather this is great news, but I don't know how great because I am a noob!
Does it mean that my 2017 Wifi E4 can be hacked?
-
Yes if it is hardware 2.0 and software v3.9.0
-
When the camera came up with enhanced res for the first time, i was stunned with the quality of the image. Subjectively it appeared to have less noise than the older E4 and less artifacts to calibrate out from cold start. Perhaps they improved the microbolometer a little bit.
-
Mine is indeed 2.0L and 3.9.0.
Where do I begin? This is quite overwhelming for someone like me who doesn't know the first thing about programming. I would be very grateful for any advice!
-
Begin from learning how to get an FTP connection to the camera to get access to the camera files. You will need this for anything else.
-
Thank you, Bud.
I have Windows 7 64 bit, so is it still the case (like a 2015 tutorial says) that I need to run a different operating system?
-
I did it on Win 7 64-bit.
-
I'm in the same position as you, Cricri.
There are over 300 pages in the usual e4 forum, so an updated step-by-step (just for 3.9.0) would be much appreciated.
-
Once you know how to talk to the camera using an FTP software , learn how to locate, decrypt and re-encrypt the config file. Download and use this tool for decryption/encryption:
https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1180237/#msg1180237 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1180237/#msg1180237)
(make a full backup of the camera flash drive first)
-
For any other noobs like me, I offer this useful article:
http://fubar.gr/hacking-the-flir-e4/ (http://fubar.gr/hacking-the-flir-e4/)
So far it has helped me to switch to RNDIS mode, use Filezilla with the username Flir and password 3vlig, and backup the Flir E4 files. Obviously those simple steps apply to all firmwares, so at what step does the process become different for 3.9.0? I am hesitant to proceed lest this article be outdated.
-
About to buy a FLIR E4 (with or without WiFi I don't know yet..).
I'm also a noob and look forward to instructions to "enhance" it! :)
-
You have to wait a little bit, there are only so many hours in a day.
-
I want to know with what file did you decrypt
Conf.cfg
I gave a link in my reply #135 above, did you read it ?
you decrypt conf.cfc, not .cfg
-
Hello cricri103
Conf.cfc decrypt / encrypt cfccfg_V2.py. You have to have this module imported into Python.
You place the conf.cfc in the python root directory, open the cmd command line, enter the python folder and paste (cfccfg_V2.py XXXXXXXXXXXXXXXX conf.cfc conf.cfg) enter, xx = your suid.
https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg594600/#msg594600 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg594600/#msg594600)
https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/6575/ (https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/6575/)
PW. Sorry for my English
-
Yikes, this is a daunting task!
-
Why don't you try and tell us.
-
Interesting discovery!
One more shooting mode has been liberated - "Sport", which in turn brought a new palette with it - "Medical". Not sure at the moment what it is for but my guess is the Sport mode could be for taking pictures of fast moving objects. A controlled experiment to confirm this would be needed. But together with the Medical palette it make sense that they may be used for medical termography, perhaps by medics of sport teams or by medical researches. Below are samples of static objects how a hand and alien cat look under the medical palette.
(https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/?action=dlattach;attach=360862;image)
-
Also interesting:
while playing around with recording videos via USB, discovered that the camera responds to the DirectShow driver settings, Zoom specifically. When change the slider control on the PC the camera changed Zoom level. Cool! Trying to change Brightness control caused the camera temperature scale to go crazy. Might have something more to discover...
-
Interesting discovery!
One more shooting mode has been liberated - "Sport", which in turn brought a new palette with it - "Medical". Not sure at the moment what it is for but my guess is the Sport mode could be for taking pictures of fast moving objects. A controlled experiment to confirm this would be needed. But together with the Medical palette it make sense that they may be used for medical termography, perhaps by medics of sport teams or by medical researches. Below are samples of static objects how a hand and alien cat look under the medical palette.
(https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/?action=dlattach;attach=360862;image)
Looking awesome!
-
Just realized it is the 4th anniversary of E4 liberation. Mikeselectricstuff published his info in 2013 October. Now it is 2017 October. 4 years and they can't plug the leak :P
Several generations of firmware has been set free and now moving to liberating new hardware platform. Let's see what we've got here...
-
Another feature has been liberated. :)
The 2017 E4 can now add notes to pictures. They become part of the EXIF header and can be viewed with Exif Tool or other Exif viewer , as well as should be visible in Flir Tools software.
(https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/?action=dlattach;attach=361659;image)
-
And a special feature from Bud, not being present in Ex series cameras: graphics overlay toggle using the Back button. Toggle the button to enable/disable the overlay. Very useful if only want to see the scene with no temperature scale and stuff. Provides 100% use of the screen real estate. :-+
You are welcome. :D
(https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/?action=dlattach;attach=361666;image)
-
This keeps getting better..
You're sure adding suspension here! 8)
-
Whilst this might be frustrating for some, I appreciate Bud taking his time with this. I'd much rather see a nice swanky hack published, that results in less bricked devices.
That is of course, if bud decides to share!
-
Don't worry, it is coming, but yes what I am doing it is not as simple as patching a couple bytes and all of a sudden all opens up. This is a tedious process of guessing, tweaking config files, implanting code from other device models, thinking, endless trying and some time failing. You do not want to end up with an expensive brick, I do not either.
-
:-+ :-+
keep on going, that looks really great
-
We are so sorry you lose your time. It is our guess it was your own choice to do so and not wait.
Tip: restore your original config file to get MSX back.
-
And a special feature from Bud, not being present in Ex series cameras: graphics overlay toggle using the Back button. Toggle the button to enable/disable the overlay. Very useful if only want to see the scene with no temperature scale and stuff. Provides 100% use of the screen real estate.
And one sorely needed in all such cameras! That was always the most annoying part of UVC streaming on my old E4, the inability to turn off the overlay.
"Not present in Ex series cameras", does that mean it's present in some other Flir models and you brought it over somehow? Or did you implement that from scratch?
(Don't suppose any of 'em have the ability to stream both the IR and Visible images simultaneously, say like a side-by-side image?)
... not as simple as patching a couple bytes...
... implanting code from other device models...
???
At risk of derailing what's already probably one of the most breathlessly-anticipated developments on the forum (at least to me!), I feel like your methodology here might also be worth its own thread or something. I'm more of a hardware guy so maybe I'm the only one absolutely mystified by what you're doing, but.. mixing and matching snippets of compiled code, it sounds like? 'Ow the 'eck do you do that?
I guess all the cameras in the series are based on the same processor, and even other series are probably on the same general architecture, but still, I can't just slice up part of Word.exe and paste it into Excel.exe and change the way it works. Can I? Aren't there a gazillion things done by the compiler and linker, which you'd have to manually adjust every time you move parts around?
Welp, I just ordered a new E4 Wifi to replace the old (stolen) one. Can't wait to see how this turns out. Bud, if you're ever in Detroit, hit me up for a beer or something!
-
"Not present in Ex series cameras", does that mean it's present in some other Flir models and you brought it over somehow? Or did you implement that from scratch?
Programmable button is present in higher end cameras, they have a dedicated "P" button, e.g. T640 and E75 shown in the attached picture. Ex cameras do not have that physical button, so I found a way to map one of the buttons (I used the Back button) to the programmable button function. And unlocked the code that controls that function.
I agree that hiding the overlay is a very useful feature, but the P-button can do more and is configurable in the Settings screen. I found Hide Graphics and Switch between two last palettes the most useful options to me, something that I use really often.
(Don't suppose any of 'em have the ability to stream both the IR and Visible images simultaneously, say like a side-by-side image?)
Not sure but I think any of the camera can only stream one type of video at a time.
.. mixing and matching snippets of compiled code, it sounds like?
Not exactly, it is a mix of compiled code and scripts, and there is not much you can do to compiled code, but scripts are editable. This approach is not new, user janekivi used it extensively in his update packages for the previous generation (2.3.0) E4.
I guess all the cameras in the series are based on the same processor
May not be the same processor but many of them seem to be ARM Thumb, up to very expensive models. Not sure what the highest ones run.
Bud, if you're ever in Detroit, hit me up for a beer or something!
You said it! :)
-
EEPROM unlock code found ! 8)
-
EEPROM unlock code found ! 8)
Well done, Bud! That's impressive, do you know what the new pw is?
-
Hard to guess if you are not a Swede:
ArneAnka
Google who Arne Anka is :D
Edit: The code was provided for learning/exploratory purpose. Be smart and do not change anything in the EEPROM, it may be devastating to the device.
-
:-DD
If you want to hack scandinavian gear try some combinations of: KalleAnka, AndersAnd etc.
Funny enough some of our Swedish gear have AkuAnkka as default password. ;D
-
:-DD :-+
-
Just wondering, if I was to have a recent E4 (without WiFi), could a 'hack' as this enable WiFi?
Or would this method even only work on a E4 WiFi version?
@ Bud, I don't know how you do your magic, but it's impressive!
B.t.w. I can't find the firmware version 3.9 (which I thought was posted somewhere).
Does anybody know if it has been removed or am I loosing my eye sight?
-
Just wondering, if I was to have a recent E4 (without WiFi), could a 'hack' as this enable WiFi?
Or would this method even only work on a E4 WiFi version?
@ Bud, I don't know how you do your magic, but it's impressive!
B.t.w. I can't find the firmware version 3.9 (which I thought was posted somewhere).
Does anybody know if it has been removed or am I loosing my eye sight?
3.9 can be found here:
http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_ex_pn639_v3.9.0__update_pack.zip (http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_ex_pn639_v3.9.0__update_pack.zip)
Hard to guess if you are not a Swede:
ArneAnka
Google who Arne Anka is :D
Edit: The code was provided for learning/exploratory purpose. Be smart and do not change anything in the EEPROM, it may be devastating to the device.
Does this mean that the camera could be set as an E8 and be seen as an E8 in flir tools?
-
The camera ID can be changed in the EEPROM, but this in no way changes the cameras operating configuration. Yes it will be identified as an E(whatever number) but this was normally only done by people who wanted their camera to be as close to looking like an E8 as possible. Personally, I am proud of my upgraded E4 and it is now so much more than an E8 anyway :)
Fraser
-
It is two separate things i think. Camera resolution/ menu enhansement and ID-ing in Flir Tools. The former does not have to do with the ID in EEPROM, the latter may - need to be tested, i have not tried.
I can't recall if stock E4 WiFi has EEPROM web page, i uploaded and am using a web pack from one of earlier camera models which had it. But most of other functions in Service menu are not working i.e. Bad pixel replacement map.
-
@ Bud, I don't know how you do your magic, but it's impressive!
Findig a way to beat the 2-layer hash validation in applauncher was the most challenging and took a few sleepless nights. The rest is easier but takes a LOT of editing, trying and rebooting. I am on my 300-ish restart counter as reported in Camera Information screen.
I recall i glanced over E75 file system and it seemed to have using the same 2-layer-ed hash , so my educated guess is E75 can be liberated to E95 configuration using the same procedure.
-
@ Bud, I don't know how you do your magic, but it's impressive!
Findig a way to beat the 2-layer hash validation in applauncher was the most challenging and took a few sleepless nights. The rest is easier but takes a LOT of editing, trying and rebooting. I am on my 300-ish restart counter as reported in Camera Information screen.
I recall i glanced over E75 file system and it seemed to have using the same 2-layer-ed hash , so my educated guess is E75 can be liberated to E95 configuration using the same procedure.
If I was rich I'd buy you an E75 so we could find out.
-
@ Bud, I don't know how you do your magic, but it's impressive!
Findig a way to beat the 2-layer hash validation in applauncher was the most challenging and took a few sleepless nights. The rest is easier but takes a LOT of editing, trying and rebooting. I am on my 300-ish restart counter as reported in Camera Information screen.
I recall i glanced over E75 file system and it seemed to have using the same 2-layer-ed hash , so my educated guess is E75 can be liberated to E95 configuration using the same procedure.
The newer Exx series use Linux, but I assume that it won't make any difference? Would be good to unlock it to the full 640x480!
Sent from my iPad using Tapatalk
-
Tried to download 3.9.0 but there was no file. On Flir's site there is 3.12.0 now http://flir.custhelp.com/app/account/fl_download_software (http://flir.custhelp.com/app/account/fl_download_software)
-
Tried to download 3.9.0 but there was no file. On Flir's site there is 3.12.0 now http://flir.custhelp.com/app/account/fl_download_software (http://flir.custhelp.com/app/account/fl_download_software)
Wow, just worked for me a few hours ago.
New 3.12.0 direct download: http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_ex_pn639_v3.12.0_update_pack.zip (http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_ex_pn639_v3.12.0_update_pack.zip)
-
@peppy88
Download the 3.12.0 and hold on to it for now, we will see what we can do.
@Chanc3
The newer Exx series use Linux, but I assume that it won't make any difference? Would be good to unlock it to the full 640x480!
I checked again and E75...E95 are Part # 785 and look totally different animal, perhaps as you saying it is Linux. So I was incorrect. I guess I was reviewing files for E40...E60 series which is Part # 645, and that one still seems to be EEV Blog friendly.
-
Just wondering, if I was to have a recent E4 (without WiFi), could a 'hack' as this enable WiFi?
Or would this method even only work on a E4 WiFi version?
I'd think it would not have the WiFi hardware. So WiFi may not work but the rest should work.
-
OK lets see what else we've liberated...
- Data overlay. Provides a selection of parameters that can be displayed in addition to usual measurements and controls information.
(https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/?action=dlattach;attach=364343;image)
- External Window Compensation. Provides compensation of temperature readings when there is an external IR window is in front of the camera. Not sure what use cases for it may exist, do not ask me how you can use it, I am just making it available. Perhaps @Fraser could provide an advice.
(https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/?action=dlattach;attach=364345;image)
- Time Lapse. Takes the configured number of shots separated by a specified time interval. Minimum interval is 15 sec for now, will see if can be shortened. Shots are saved as separate files with the usual naming convention.
(https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/?action=dlattach;attach=364347;image)
- Screening mode. Sets an alarm when measured temperature exceeds a specific threshold. Documentation specifically mentions use case for screening sick people at airports. You set temperature threshold and hysteresis and the alarm icon will turn Red when measured temperature goes above the threshold. My recollection is it also writes events in a log file on the flash drive, so it can either be examined later, or remotely monitored in real time via Telnet or ftp. Only the high end cameras ($20,000-$40,000) have this feature. Now available in E4 for only a kilobuck 8)
(https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/?action=dlattach;attach=364349;image)
Seems it is going to be the most massive liberation of E4 since sliced bread >:D
-
!!!!
Where do we buy the Bud update pack? Hahaha
-
Bud,
External IR windows are used on the casings of hazardous euipment such as high energy utility supplies. They enable inspection of the equipments interior without breaching the safety containment. Such windows are made from various thermal wavelength transmissive materials but the transmission % varies. The FLIR External IR window menu enables the user to select the correct transmission figure for the IR window that is in use. The camera then compensated for the transmission loss when taking measurements through the window.
https://www.tester.co.uk/downloads/dl/file/id/2610/product/11398/flir_irw_infrared_window_datasheet.pdf (https://www.tester.co.uk/downloads/dl/file/id/2610/product/11398/flir_irw_infrared_window_datasheet.pdf)
https://www.tester.co.uk/flir-irw-infrared-window-choice-of-size?fee=3&fep=11398&gclid=CjwKCAjwssvPBRBBEiwASFoVdwl_YDY_2QjMiyKD5P9ZrwkrngjNog92AmScuNWrWXcWvNpnSmMsZBoC7SEQAvD_BwE (https://www.tester.co.uk/flir-irw-infrared-window-choice-of-size?fee=3&fep=11398&gclid=CjwKCAjwssvPBRBBEiwASFoVdwl_YDY_2QjMiyKD5P9ZrwkrngjNog92AmScuNWrWXcWvNpnSmMsZBoC7SEQAvD_BwE)
An external IR window compensation feature that permits manual entry of the transmission figure can be very useful when experimenting with auxiliary lenses. Such permits the transmission losses of the additional lens block to be compensated out of measurements in order to provide more accuracy. The FLIR 'T' series provides external window and lens compensation in its measurement correction options.
There should be two data entry fields or menu's, temperature and transmission %. In your picture I suspect the 20 is the temperature in Degrees C, and the 100 is the default transmission set to 100%. I would expect there to be a way to change these two entries, such as the 'rotating' tumbler wheels used elsewhere. Some functions require the touch screen to use them.
FLIR's ITC have produced a guide for establishing the transmission losses of an IR window so that measurements may be corrected.
http://flir.custhelp.com/ci/fattach/get/9908/0/session/L2F2LzEvdGltZS8xMzY5NjUyNTI2L3NpZC9nKkNjLWRybA==/filename/Tech+Pub+-+Easy+Window+Transmission+Measurement.pdf (http://flir.custhelp.com/ci/fattach/get/9908/0/session/L2F2LzEvdGltZS8xMzY5NjUyNTI2L3NpZC9nKkNjLWRybA==/filename/Tech+Pub+-+Easy+Window+Transmission+Measurement.pdf)
External window transmittance by FLIR's ITC
http://support.flir.com/Answers/A817T/A817-T560472_A-en-US%20Technical%20publication%2060%20Window%20or%20External%20Optics%20Transmittance.pdf (http://support.flir.com/Answers/A817T/A817-T560472_A-en-US%20Technical%20publication%2060%20Window%20or%20External%20Optics%20Transmittance.pdf)
Fraser
-
That is great Fraser, thank you. Sounds a useful feature for experimenters.
Yes turning ext window compensation on enables value selection scroll lists for temperature and transmission coefficient. This information is also then added to the Exif header in the images taken with it enabled.
-
Just got my E4 2.0L with stock 3.5 FW.
Reading all the threads I just can't find 3.9 FW update ( the file is lost... ) and on Flir site there is only latest 3.12.
Can someone upload a 3.9 update, or 3.12 is also ok ? Anyone @Bud ?
-
Thanks for the previous answers and clarifications guys..
I'm wondering the same thing..
-
Thanks to my brother fellow Hungarian I managed to update my camera to FW 3.9 8)
Now comes the tricky part :) Anyone willing to help ?
-
@Markofq Where did u get the 3.9.0 firmware?
-
Here it is
https://www.mediafire.com/file/z2e44uvzm99u9a7/v3.9.0__update_pack.zip (https://www.mediafire.com/file/z2e44uvzm99u9a7/v3.9.0__update_pack.zip)
-
Hi All! I have two E4's, one with 2.11.0 that I successfully applied the res and menu hack to, and the other one is a 2017 3.9.0 FW and 2.0L HW which I successfully retrieved the SUID and decrypted the CFC. I now have the CFG file and not sure where to go from here to do the res hack plus the menu hack and all the extras Bud is adding. Do I just edit the cfg file and change everything to "True" and enter the 320x240 resolution and re-encrypt the file or do I need to generate a new DLL as well?
Please help. ;D
-
It is in development and has not been published yet, you have to wait.
-
Thank you Bud!
Great work btw! :-+
-
Thanks for the v 3.9 file Markofq!
-
Some nasty surprizes coming with
3.1.20 3.12.0
qml_context_property type="string" name="registrationNag" value="N/A"
...
ui_model type="RegistrationWizardModel" name="registrationWizardModel" ... title="CAMERA_REGISTRATION_TITLE"
...
some other related crap such as screen to enter some verification code
:--
The new update has no anything new beside the forementioned registration screen for you to register the device and , guess, a nag screen if you don't.
Unclear if they introduce it in 3.12.0 or prepairing to be introduced in one of the next releases. Because of this and because 3.12.0 has no any technical feature updates, I do not recommend updating to 3.12.0. Stick to 3.9.0 for as long as you can.
-
Basic update package for E4 2.0L WiFi fw v3.9.0
DISCLAIMER: YOU PERFORM UPDATE AT YOUR OWN RISK
It is an endless endeavor to dig into and navigate the E4 gold mine of undocumented features , so I split the update to parts. If all you need is enhanced resolution , new palettes and measurement presets, this Basic package is for you. You can always upgrade later to the next level. It may even be possible that the Advanced package will have too much for you and you will want to roll back to this Basic package. There is so much stuff in Advanced one that not many people will be able to use it and it will only complicate the menu and settings. By starting with Basic one you also learn the procedure and navigating the user interface, so stepping the level up will be easier to digest the overwhelming amount of liberated stuff that comes in Advanced bucket.
Always make a backup copy of your stock camera before applying the mods. You will need it to roll the change back in case of problems or if you decide to sell the camera.
With the mods in place you should NOT apply firmware updates published by the camera manufacturer. Such updates may overwrite critical files and the camera may stop working. If you want to apply such update you first have to remove the mod and return to stock configuration. However you cannot re-apply the mod that was made for the earlier firmware versions. There is high risk of bricking the camera in such scenario.
The mods are provided for your personal use. In case you need to sell the camera, please roll the change back to stock firmware. There will be a quick splash screen at startup reminding you of that. If someone, who is not aware of the said condition in the previous paragraph, buys a mod-ed camera from you and applies a manufacturer firmware update, the person will end up with a bricked camera. Please be considerate and do not do that.
This update was made for and using E4 2.0L 3.9.0 WiFi version device. It has not been tested on a non-WiFi device, though my thoughts are it should work there too. You will have to use USB and RNDIS mode though to apply the update.
PS: the archive has two files because of limitation on attachment file size.
Edit: please take note of errata/typos Markofq posted 3 post below
'********************************************************
Recovery procedure
Use the following procedure to revert the change if update was not successful and your camera stuck in boot logo screen or blank screen.
- Power down the camera and disconnect from USB if connected
- Reconnect USB. Do NOT power on the camera.
- Run FlirInstallNet and upload the temporary RNDIS fif file
- Wait for the camera to get IP address assigned as usual, ping 192.168.0.2 and make sure the camera responds to ping.
- Run FTP and connect to the camera using the following credentials:
user: anonymous
pass: NcFTP@
- You should now have access to files on the camera and restore your original files from backup.
- Power down the camera, remove the battery for 10 sec and put it back.
'********************************************************
Update Dec 23, 2017:
Advanced update package:
https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1382599/#msg1382599 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1382599/#msg1382599)
'==========
Update: Additional enhancement for the GUI here:
https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1401621/#msg1401621 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1401621/#msg1401621)
'********************************************************
Update Dec 25, 2019:
2019 Christmas Pack:
The 2019 Christmas Pack adds another powerful feature - custom User Presets. For details follow the link:
https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg2844298/#msg2844298 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg2844298/#msg2844298)
'********************************************************
'=====================
Update March 7, 2019: So far the following FW versions confirmed working: 3.9.0, 3.11.0, 3.12.0, 3.13.0, 3.16.0. They may use different packages, you need to scan this thread for information and attachments for a particular fw version.
'=====================
-
Bud,
Excellent work.
I am pleased and impressed that you have considered the issue of upgraded cameras being vulnerable to bricking if newer firmware is loaded, and your consideration for potential buyers of an upgraded camera :)
Excellent :)
Fraser
-
Thanks Bud ! :-+
I have a non WIFI model, I will try it and let you know.
-
Thank you bud for your work.
On Flir E4 without Wifi 3.5.0 2.0.L does not work.
Replacing common_dll.dll causes a crash on the flir logo.
Does common_dll.dll 3.9.0 differ from common_dll.dll 3.5.0?
Later, I will update the camera to 3.9.0 and see if I am happy.
-
@Bud
The update went fine 8)
There were some typos in readme:
3.1 FlashIFS\version.rsc should be FLIRVers.rsc
7 when typing python cfccfg.py file ( the downloaded file has a _V2 on it so people should rename it or just point to right file )
9 (b) FlashFS\system\common_dll.dll the correct path is FlashBFS\system\common_dll.dll
And for the record this works with NON wifi model also!
Thanks !
-
@gregor11
Did not i make it clear enough in the instructions what fw version it is for?
Edit: this exactly illustrate my point on danger of mixing fw versions.
You should roll back, update to 3.9.0 and go from there.
-
@bud
do you think a 3.12.0 to 3.9.0 downgrade is possible? Want to know in case I get one that already comes with 3.12.0
-
@Bud
The update went fine 8)
There were some typos in readme:
3.1 FlashIFS\version.rsc should be FLIRVers.rsc
7 when typing python cfccfg.py file ( the downloaded file has a _V2 on it so people should rename it or just point to right file )
9 (b) FlashFS\system\common_dll.dll the correct path is FlashBFS\system\common_dll.dll
And for the record this works with NON wifi model also!
Thanks !
Thanks!
that is embarrasing typos. This is what happens when posting at 4am after working all day.
All - please take a note before i fix the typos in the package and download the archive again, the instructions file has been updated.
-
Thanks Bud for the description.
For me the updated failed. For other users it would be nice if you could add the description of how to setup the camera in RNDIS mode. I found a description for older firmware using FlirInstallNet.exe and some fif files, but using that description it seems it changes some wrong things in the new firmware version, as in device information nothing is shown about the resolution of the camera anymore and the build in normal camera does not work anymore.
FYI, the right way to set the camera in RNDIS mode is by going into the camera information menu and holding the right menu key for more than 10 seconds. Then you get a diagnostics menu where you can sat USB mode etcetera.
If anybody has a tip on how to get back normal camera functionality let me know.
-
@Bud
The update went fine 8)
There were some typos in readme:
3.1 FlashIFS\version.rsc should be FLIRVers.rsc
7 when typing python cfccfg.py file ( the downloaded file has a _V2 on it so people should rename it or just point to right file )
9 (b) FlashFS\system\common_dll.dll the correct path is FlashBFS\system\common_dll.dll
And for the record this works with NON wifi model also!
Thanks !
Thanks!
that is embarrasing typos. This is what happens when posting at 4am after working all day.
All - please take a note before i fix the typos in the package and download the archive again, the instructions file has been updated.
No problem m8,
About menu, if I edit toolbar-config.xml and remove this
<ToolBar name="new_settings"/>
<ToolBar name="recordingModeMenu">
<ToolBar name="recordingMode_still"/>
</ToolBar>
Is it all that is needed to be done to get rid of that toolbar "recording mode" ? ( since I don't see a reason beeing there it does nothing for me )
-
About menu, if I edit toolbar-config.xml and remove this
<ToolBar name="new_settings"/>
<ToolBar name="recordingModeMenu">
<ToolBar name="recordingMode_still"/>
</ToolBar>
Is it all that is needed to be done to get rid of that toolbar "recording mode" ? ( since I don't see a reason beeing there it does nothing for me )
There will be more recording modes in Advanced pack, but you can leave it that way, a new toolbar-config.xml will be supplied with it.
-
For me the updated failed.
You did not say what hardware and original fw version you camera is.
For other users it would be nice if you could add the description of how to setup the camera in RNDIS mode.
I cant spoonfeed everyone. Do I also need to teach people how to use FTP? Telnet? How copy files? Rename files? People are expected to do their homework.
I found a description for older firmware using FlirInstallNet.exe and some fif files, but using that description it seems it changes some wrong things in the new firmware version
I still use FlirInstallNet and fif filesfor RNDIS back from 2014. I do not know why yours did not work.
FYI, the right way to set the camera in RNDIS mode is by going into the camera information menu and holding the right menu key for more than 10 seconds. Then you get a diagnostics menu where you can sat USB mode etcetera.
You certainly have not tried that, otherwise you would know it does not work. That screen was locked long time back by Flir and it is not possible to change USB from that hidden menu.
If anybody has a tip on how to get back normal camera functionality let me know.
- Power down the camera and disconnect USB if connected
- Reconnect USB. Do NOT power on the camera.
- Run FlirInstallNet and upload the temporary RNDIS fif file
- Wait for the camera to get IP address assigned as usual, ping 192.168.0.2 and make sure the camera responds to ping.
- Run FTP and connect to the camera using the following credentials:
user: anonymous
pass: NcFTP@
-You should now have access to the files and copy back your original files from a backup. I trust you made a backup before trying the update.
-
Thanks bud.
I read that for 3.9.0.
I just wanted to check if it works with 3.5.0, it just updates to 3.9.0.
-
Thanks Bud for the description.
For me the updated failed. For other users it would be nice if you could add the description of how to setup the camera in RNDIS mode. I found a description for older firmware using FlirInstallNet.exe and some fif files, but using that description it seems it changes some wrong things in the new firmware version, as in device information nothing is shown about the resolution of the camera anymore and the build in normal camera does not work anymore.
FYI, the right way to set the camera in RNDIS mode is by going into the camera information menu and holding the right menu key for more than 10 seconds. Then you get a diagnostics menu where you can sat USB mode etcetera.
If anybody has a tip on how to get back normal camera functionality let me know.
I used fif files from 2.11.0 Hack files and it worked both ways to RNDIS and back to MSD/VDC mode.
-
Thanks bud.
I read that for 3.9.0.
I just wanted to check if it works with 3.5.0, it just updates to 3.9.0.
NO, do not attempt doing it on 3.5.0 , it will not work.
-
Bud,
First of all, great job and thanks for all the hard work! I tested with my 2017 WiFi 2.0L/3.9.0 and everything went well.
There's one typo:
10. Transfer the new common_dll.dll from the working folder to the camera -> FlashFS\system\ Should be changed to FlashBFS\system\
-
Thanks CABNY, that was already reported and has now been fixed and an updated archive uploaded.
Enjoy your camera !
-
@bud
do you think a 3.12.0 to 3.9.0 downgrade is possible? Want to know in case I get one that already comes with 3.12.0
I do not know, sorry...
-
When switching to 3-spot measurement, on my non-wifi camera I get a box with center spot and one cold and one hot spot. On the wifi model I get no box with three spots side by side. Is there a setting that I'm missing?
Also, is the box size changeable?
Can't wait to see what comes out with the Advanced pack! Thanks again Bud! :-+
-
Copy the 3-spot preset .rsc file from the first camera to the second one, that should do it. But you can have only one of them, unless you sacrifice one of other presets and use its filename for your second 3-spot tool.
Box size may be changeable in the preset file, check there if it has box dimensions specified.
-
BTW check out the programmable button, there is a setting for it in the Settings screen. Again, on the liberated E4 it is the Back button.
-
Copied preset_threeSpots.rsc to /FlashBFS/system/ui.d/presets.d/ and it's working great!
Thanks again!
-
Thanks Bud for the description.
For me the updated failed. For other users it would be nice if you could add the description of how to setup the camera in RNDIS mode. I found a description for older firmware using FlirInstallNet.exe and some fif files, but using that description it seems it changes some wrong things in the new firmware version, as in device information nothing is shown about the resolution of the camera anymore and the build in normal camera does not work anymore.
FYI, the right way to set the camera in RNDIS mode is by going into the camera information menu and holding the right menu key for more than 10 seconds. Then you get a diagnostics menu where you can sat USB mode etcetera.
If anybody has a tip on how to get back normal camera functionality let me know.
I used fif files from 2.11.0 Hack files and it worked both ways to RNDIS and back to MSD/VDC mode.
Would I be rude to ask if you could post these files?
I'm a newby at this and can find files about hack 2.3.0 (http://fubar.gr/hacking-the-flir-e4/ (http://fubar.gr/hacking-the-flir-e4/)) but not the 2.11.0 and I'm not sure they're the same.. :-[
-
Thank you very much for the E4 hack!
I am stuck on step 7 when I type python cfccfg_v2.py XXXXXXXXXXXXXXXX [which I have replaced with my SUID] conf.cfg conf.cfc .
The Python command line says syntax error about the file in line 1, but I think that I downloaded the v2 file ok. I know you don't like to spoonfeed people, Bud, but help would be appreciated!
-
I tried restarting my computer so that Python was installed correctly, and I remembered to extract the V2 file. I installed the 2.7 version of Python, but I will look for another version to see if that fixes it.
-
I am sorry if there are the two things in life that i am clueless about , they are python and linux. If you can post a screensot of the error someone may be able to recognize it and help.
Also make sure you are using python v2.7. I tried several versions from 3.0 i believe and higher and none worked. I had to uninstall them and use v2.7.
In fact, i was going to ask people who knows python to help rewrite the script to work inder newer python versions. If someone can do that it would be a good refresh for the tool.
-
Thanks for trying, Bud!
This is the first time I am even using a command line, so I can only guess.
Judging by the syntax error, here are some possibilities:
I am typing it in a way that Python does not understand;
Python cannot find the file because I've put it in the wrong place;
Something went wrong with my installation of Python.
-
I was being dumb, but at least I've learnt about the command line now.
The CFC has been created, now that I put C:\ and all that jazz before the file name. Of course the computer didn't know where to find the file because I didn't put its location. That is programming 101, I know, but I haven't taken that class!
I bet you PC-Einsteins are laughing at the screenshot I posted!
-
Thanks again, Bud; your instructions were so clear that even a noob like me hacked it!
-
Thanks and glad it worked for you. Take care of your backup archive.
-
Would I be rude to ask if you could post these files?
I'm a newby at this and can find files about hack 2.3.0 (http://fubar.gr/hacking-the-flir-e4/ (http://fubar.gr/hacking-the-flir-e4/)) but not the 2.11.0 and I'm not sure they're the same.. :-[
pull the RNDIS fif files from this zip archive
https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg531346/#msg531346 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg531346/#msg531346)
I recommend only using the Temporary one. You will be in better control over the camera USB interface. The Temporary fif only enables RNDIS until reboot, after which the camera returns to UVC mode. You will perhaps need to run it 2-3 times during the procedure as you reboot but it makes sure the camera will not get stuck in RNDIS using some weirdo IP settings which may give you headache and inability to connect to it. Ask me how I know this.
-
I added recovery procedure to my original post on Page 8. I use it countless times and it worked well for me every single time. In fact, I found it is very difficult to brick the camera, Flir did a good job on putting this "side door" in place that gives access to the filesystem without booting the device. The real danger is when you begin mixing firmware and hardware versions, this may cause unpredictable results and kill all entry points. So do not do that.
-
Thanks Bud!
As wel as for the RNDIS mode advice!.. I don't think I dare to ask you why u know.. ;)
I'm getting the E4 (no wifi, could not buy that in my region) tomorrow.
Also, thank you for sharing your magic!!! :-+
-
Copied preset_threeSpots.rsc to /FlashBFS/system/ui.d/presets.d/ and it's working great!
Thanks again!
Can u upload that preset ?
Tnx
-
Bud, that's a great job. Works on my E4, 2.0L model that arrived for some reason with FW 2.3.0 here, but the hack didn't work. Resolution did enhance, but menus not and crosshair was gone. Didn't work with 2.11.0 either. So I'm lucky you made this one. Reverted the hacks and updated the camera to 3.9.0, applied the modifications according to your readme file, and tadaa - it works.
There's one thing I'd like to ask (just for clarity): does your basic packacke include some changes or additions to the palettes or menus? Apparently nothing changed here for my camera, so if there should be more, I'd have to investigate again, otherwise I'm just fine for now.
BTW the hidden menu is still there (10 sec keypress ...), but doesn't change the USB mode. I've set mine to RNDIS using this menu while the older firmware was running, and don't bother reverting it until all patches are done. I also had various problems, most of the time just not working, using the .fif to change the mode. Not yet tried with the 3.9.0 FW.
-
try this. unzip it first.
-
There's one thing I'd like to ask (just for clarity): does your basic packacke include some changes or additions to the palettes or menus? Apparently nothing changed here for my camera, so if there should be more, I'd have to investigate again, otherwise I'm just fine for now.
It has more palettes and measurement tools, but you appeared to have them enabled by the previous hacks. I did not maintain a list of what i enabled, if i saw something i just enabled it. Check if you got the programmable button in the settings menu, and use the Back button after you assign a function to it.
BTW the hidden menu is still there (10 sec keypress)
Should not be 10 in my package, i changed it to 3 or 4 sec.
-
Hi everybody.
Is there any difference in haking Flir e4 fw 3.9.0 with Wi-Fi and Flir e5 fw 3.9.0 without Wi-Fi? Besides "You will have to use USB and RNDIS mode though to apply the update."
-
This package is for E4.
-
This is side by side screenshots of menu and settings screens before and after.
-
This package is for E4.
thx, cap
-
This is side by side screenshots of menu and settings screens before and after.
Thanks, that makes things clear for me: The menus didn't work, resolution does. I've got the "before" menus on my E4. So I'll go back and try to find the reason, maybe I've put a file in the wrong place - would be the first thing to check.
-
Make sure to copy/replace ui_control.rsc
-
Make sure to copy/replace ui_control.rsc
ui_control.rsc was in its place at "FlashBFS/system/appcore.d/factory.d/", but there was another ui_control.rst at "FlashFS/system/appcore.d/factory.d/".
Apparently a leftover from a previous hacking attempt, after deleting the latter one, everything is fine. I've received the camera with FW 2.3.0 installed on HW 2.0L, as far as I read all the posts here, this can't be the state this camera left the factory, it's also quite new (last calibrated in March 2017). So I guess there's been a non successful attempt to hack it, don't know if the file was transferred by me to the wrong place or has been there before. Anyway, it's working now, I'm waiting for your extended package.
Thanks again, Bud!
Edit: I've reset USB to default and RNDIS access works now best in the way you describe as "Recovery procedure". No password required / any password works. Way more files are accessible through FTP now, no need to stop the app. My Win7 laptop appears to lesser fool me with IP addresses in this mode, the camera comes up more reliably with 192.168.0.2
-
That is great. Did not know they dropped password. I think you were lucky the downgrade the previous owner performed did not cause (apparent) problems.
-
Found a bug with WiFi on liberated 2.0L 3.9.0 (may be the case with stock device as well)
When you connect the device to wifi, they take it to another location and try to connect it to another SSID, the interface will flash a message that it could not connect to the previous SSID and it will freeze before being able to enter your wifi password and only way to continue is remove battery or hold power button for 5 seconds.
Only way I found to get around it is turn wifi off, then back on and select the new SSID.
-
Not sure i understand the "..they take it to another location" part but do not see how it may have anything to do with the change. What would be steps way to reproduce the issue?
-
What I did was join wifi at my office, then went home, tried to join wifi there and before I was able to enter the password after selecting the SSID, a pop-up that it couldn't connect to my office wifi and screen froze up. This happened again even after removing and re-inserting the battery.
I'm going to try joining my office wifi again tonight and see if it happens again the other way around.
-
Sounds like a bug in wifi implementation. Turning wifi off before joining a different network makes sense.
-
For any other noobs like me, I offer this useful article:
http://fubar.gr/hacking-the-flir-e4/ (http://fubar.gr/hacking-the-flir-e4/)
So far it has helped me to switch to RNDIS mode, use Filezilla with the username Flir and password 3vlig, and backup the Flir E4 files. Obviously those simple steps apply to all firmwares, so at what step does the process become different for 3.9.0? I am hesitant to proceed lest this article be outdated.
Sam, did you follow the procedure from this link up to (and not including) the part "6. Script pack"?
(Including using the device drivers in their link, FlirTools v. 4.1 and Pyton 2.7.9?) (As recommended by Bud, we should use the FLIRfif from another package..)
And then continuing with "Switching camera to RNDIS mode"?
I'm new to this stuff and stuggling a bit..
-
I was being dumb, but at least I've learnt about the command line now.
The CFC has been created, now that I put C:\ and all that jazz before the file name. Of course the computer didn't know where to find the file because I didn't put its location. That is programming 101, I know, but I haven't taken that class!
I bet you PC-Einsteins are laughing at the screenshot I posted!
Oke, at least you're not the dumbest.. :-[
I'm stuck at the same phase, but unlike you have not figured out where to put the path..
What did you do to fix it?
Also, before I overwrite files on the camera, I want to make sure I got the backup right..
It seems like a standard windows C:\ drive folder structure (right side).
Is this correct?
-
Yes, Squawk, I followed steps 1-6 of http://fubar.gr/hacking-the-flir-e4/. (http://fubar.gr/hacking-the-flir-e4/.) Step 6 tells you to down the FLIRfif folder, which includes the Set_RNDIS_permament.fif file needed to switch to RNDIS mode. Then I waited for Bud's package, which continues where step 6 should stop (because our Flir e4 is the newer 3.9.0).
-
Regarding the back-up, that should be the easy part! I don't recognise the program WinSCP that you used (I chose Filezilla), but it's just a matter of copying and pasting. Your C: drive is where the back-up belongs, and I made one on several others of my drives just in case.
-
To answer your question about the Python step, there is an easy way to tell the command prompt (which you open by typing cmd into the Windows search bar) a file's location. Instead of typing out where your file is (C:\ etc), just drag the file on to the command prompt.
-
Regarding the back-up, that should be the easy part! I don't recognise the program WinSCP that you used (I chose Filezilla), but it's just a matter of copying and pasting. Your C: drive is where the back-up belongs, and I made one on several others of my drives just in case.
Hey Sam, thanks for coming to the resque! :)
But do you recognize the folders on the right?
Are those the ones to backup?
Cause I'm a bit surprised to see folders like "Program Files", "Windows" and "Temp".. which seem a lot like the C:\ folder structure..
-
To answer your question about the Python step, there is an easy way to tell the command prompt (which you open by typing cmd into the Windows search bar) a file's location. Instead of typing out where your file is (C:\ etc), just drag the file on to the command prompt.
But which file you mean? The conf.cfg file?
I've tried to put C:\ and C:\Python27\ in front of several places, but nothing worked.. got the same syntax error you got..
-
Hey Sam, thanks for coming to the resque! :)
But do you recognize the folders on the right?
Are those the ones to backup?
Cause I'm a bit surprised to see folders like "Program Files", "Windows" and "Temp".. which seem a lot like the C:\ folder structure..
Your picture shows that you have backed them up correctly. Just like a computer, the camera needs its own operating system, so it is normal.
-
But which file you mean? The conf.cfg file?
I've tried to put C:\ and C:\Python27\ in front of several places, but nothing worked.. got the same syntax error you got..
To make it easier to type the locations, move the V2 file and conf.cfg files to your C: folder (and in no subfolders of that). Then you would type the following (no more, no less) where xxx etc. is your SUID:
python C:\cfccfg_v2.py xxx C:\conf.cfg C:\conf.cfc
Note that it worked for me only when I told the command prompt to create the new cfc file in a location (let's make it the C:\ drive for simplicity's sake and then move it later).
-
But which file you mean? The conf.cfg file?
I've tried to put C:\ and C:\Python27\ in front of several places, but nothing worked.. got the same syntax error you got..
To make it easier to type the locations, move the V2 file and conf.cfg files to your C: folder (and in no subfolders of that). Then you would type the following (no more, no less) where xxx etc. is your SUID:
python C:\cfccfg_v2.py xxx C:\conf.cfg C:\conf.cfc
Note that it worked for me only when I told the command prompt to create the new cfc file in a location (let's make it the C:\ drive for simplicity's sake and then move it later).
Then something else is wrong.. because that combination also doesn't work.. :-//
-
Then something else is wrong.. because that combination also doesn't work.. :-//
That is exactly what I typed for myself (obviously with my own SUID), so that leaves the following possibilities:
The files still aren't where you told the command prompt they are (C: drive);
You forgot to extract the .py file (which is in a zip file when you download it);
Or I'm missing something because I am also a noob!
One other thing came to mind: try it again in Windows command prompt instead (by typing cmd into the start menu).
-
U da man! 8)
U officially r not allowed to call yourself noob again.. ;)
-
U da man! 8)
U officially r not allowed to call yourself noob again.. ;)
Aww thanks, I'll pin that quotation to my wall! haha
-
Bud, I got the hack working, but there are some issues.
(I have a non-WiFi version, E4, 2.0L firmware version 3.9.0.)
1. The spot temp doesn't show (and there are only 2 options: "No Measurements" and "Centre Spot", but both are not showing)
2. I can't select camera mode anymore (msx, pic in pic, etc.), the icon is greyed-out
3. Temp. Scale only has "auto"
4. I only have 1 row of (7) different color pallettes (not 2 rows with more options, like max, min, alarm temp, etc. as in your screenshot)
5. Recording mode only shows "Single Shot"
6. The visual camera does not record anymore (only IR)
7. I don't have the magnifying glass
8. I can't select "Add Table" in the playback mode (greyed-out)
Any solution I can try to get these things back?
-
Use the recovery procedure on page 8.
-
Use the recovery procedure on page 8.
And then re-do it?
Or will it not (never) work with my device for some reason (region or non-wifi related issues)?
Edit:
I reversed all steps from back to front, except for the restarts. All is back to normal (as when out of the box) standard E4.
There is something I found strange (added screenshot) about files not being overwritten because they're named different (z3 added) but seem to have the same function.
The blue selected files are the ones we're suppose to copy to that folder. Look at their file names in relation to the files already there..
Maybe this can be a clue as to why it didn't work for my E4?
-
For convenience, this is a summary of how to get the camera into RNDIS mode:
1. Download and install Python 2.7.9 (later/recent versions of Python don't seem to work): https://www.python.org/ftp/python/2.7.9/python-2.7.9.msi (https://www.python.org/ftp/python/2.7.9/python-2.7.9.msi)
During the installation, click the little box on the left of Python and select “Entire feature will be installed on local drive”.
Restart PC after installing Python 2.7!
2. Download and install FileZilla: https://filezilla-project.org/download.php?type=client (https://filezilla-project.org/download.php?type=client)
3. Download "e4hack3c.zip": https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/?action=dlattach;attach=113430 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/?action=dlattach;attach=113430)
Unzip/unpack the file "Set_RNDIS_temporary.fif" and copy it to C:\
4. Download and install the FLIR Device Drivers from here: http://cdn.cloud.flir.se/swdownload/assets/other/flir_device_drivers.exe (http://cdn.cloud.flir.se/swdownload/assets/other/flir_device_drivers.exe)
5. Download and install FLIR Tools: http://support.flir.com/SwDownload/app/RssSWDownload.aspx?ID=120 (http://support.flir.com/SwDownload/app/RssSWDownload.aspx?ID=120) (I used FLIR Tools+ v 6.3, which worked just fine.)
6. The first step is to connect the camera to the PC using the USB cable provided. Windows will detect the camera and automatically install the drivers.
7. When the installation is complete, navigate to "C:\Program Files\FLIR Systems\FLIR Tools\bin\" and run "FLIRInstallNet.exe".
8. Hit Browse, navigate to the "Set_RNDIS_temporary.fif" file (that you copied to C:\) and hit the Run FIF button.
When the camera is in RNDIS mode and connected to the computer, it is possible that your Internet connection will go down.
This is normal and your Internet connection will be automatically restored when the camera is disconnected.
9. On the PC, go to Start, Run, type "cmd" and press enter (you may have to run "Command Prompt" as administrator if you have trouble with the Python script later on).
This will bring up the command line interface. Type "ipconfig/all" and press enter. This will do an enumeration of all network interfaces currently on the computer.
Scroll a bit to the top and you should see the word INFRARED, which is IP of the FLIR camera (most likely 192.168.0.2).
Write down this IP adress.
10. Next, run Fillezilla. On the quick connect boxes enter the host IP (192.168.0.2 in this case), username: flir and password: 3vlig and hit Quickconnect.
-
It is time to get another E4. A wifi version this round. Any good promotion going on now?
-
And then re-do it?
Or will it not (never) work with my device for some reason (region or non-wifi related issues)?
Walk away from it for a day or two, let your mind relax, then do it again starting from downloading the package again. Print out the instructions and put a check mark against each step as you complete it. There is no reason for it not to work on a stock camera.
Maybe this can be a clue as to why it didn't work for my E4?
No , it is supposed to be that way.
-
And then re-do it?
Or will it not (never) work with my device for some reason (region or non-wifi related issues)?
Walk away from it for a day or two, let your mind relax, then do it again starting from downloading the package again. Print out the instructions and put a check mark against each step as you complete it. There is no reason for it not to work on a stock camera.
Maybe this can be a clue as to why it didn't work for my E4?
No , it is supposed to be that way.
Thanks, I'll try to be that patient.. ;)
-
After I transfered the SUID adjusted and re-encrypted conf.cfc file to the camera and rebooted for the first time, I already noticed the "Image mode" was greyed out.
So before copying/overwriting all the files from step 16.
Oh, another thing..
In the "Recovery procedure" you wrote this:
•Reconnect USB. Do NOT power on the camera.
•Run FlirInstallNet and upload the temporary RNDIS fif file
But FlirInstallNet could not find the camera and execute the RNDIS fif file unless I booted it.
I had to reverse the hack procedure to get everything back in original state.
edit: I can now..
Would that give a clue of why it didn't completely work?
-
It is time to get another E4. A wifi version this round. Any good promotion going on now?
You can get some free stuff with your order: http://www.flir.com/uploadedFiles/Instruments/Promotions/17-2667-INS-Q4-2017-FLIR-PROMO_BONUS-BUYS.pdf (http://www.flir.com/uploadedFiles/Instruments/Promotions/17-2667-INS-Q4-2017-FLIR-PROMO_BONUS-BUYS.pdf)
But the E4 Wifi is $949 and the rewards have a big bump at $1000. As far as I can tell, it should be possible to add other "test and measurement" items to get over the threshhold, so I got a soft case and a set of FLIR-branded test leads, putting me at $1008 of products. I'll let you know if it works but it might take quite a while before I find out!
-
Yesterday i have successfully "upgraded" my Flir E4 non Wifi model 2.0L. Before that i upgraded the firmware from 3.5.0 to 3.9.0. The new measuring options and enhanced IR resolution transformed the E4 into a total new beast. A big thank you to Bud and all involved for their efforts. I appreciate his time investment in all these trials getting to success. I believe he had to watch hundreds of boot screens...
regards
M
-
Addendum: I too struggled getting the E4 into RNDIS mode. The clue was: After injecting the temporary FIF file with Flirinstallnet.exe the Flir Network adapter only appeared briefly in my windows network settings and i never got a permanent connection. After clicking "Run FIF" you have to power up again the E4 and voila the network connection was stable. Took me a while to sort this out. Btw I am using Win10 Pro, i believe there is no need for a Win7 32bit. Pyhton 2.7 and Win10 pro was no problem for me.
-
Oh, another thing..
...
Would that give a clue of why it didn't completely work?
That what? Can you post one thing at a time.
-
Addendum: I too struggled getting the E4 into RNDIS mode.
Flir has been notoriously poor in implementing this piece. In my opinion part of the problem was their choice of the subnet 192.168.0.x which is often already taken by home routers. So with that you get duplicate IPs on the network and not surprizingly things become confused and flaky.
-
Oh, another thing..
...
Would that give a clue of why it didn't completely work?
That what? Can you post one thing at a time.
Oh, it worked.. the thing that I scratched through.. about getting connecting to the cam without booting it.
It works, but does show the "charge" symbol.
-
OT - from a previous post on the topic.... regarding the bonuses offered when buying an E4. They are, to me, disappointing.
The most useful gifts that could be offered would be one or more of the following...
1. Soft case
2. Spare battery
3. External battery charger dock
4. Car charger cable
5. FLIR branded Powerbank
6. Screen protectors
7. FLIR branded thermometer
The last three items are not regular FLIR items but they should add them to their accessories :)
Just my 5 Cents on that topic. I own the soft case, a spare battery and external charging dock that the FLIR dealer gifted to me when I purchased my E4 in 2013. They are very useful accessories.
Fraser
-
Bud thank you for the time you spent on this and your willingness to share!!
And Bud, Sam, thanks for your patience helping me!
I got it all working and am happy like a little kid on Christmas Eve..!! :-+
-
Download and install FLIR Tools: http://support.flir.com/SwDownload/app/RssSWDownload.aspx?ID=120 (http://support.flir.com/SwDownload/app/RssSWDownload.aspx?ID=120)
Should you use FLIR Tools / FLIR Tools+ 5.13 or FLIR Tools / FLIR Tools+ 6.3 ?
And I suppose the .exe file is what you need right? .zip file is 500MB
-
You will need FlirInstallNet.exe
If it is going to work by its own without any other installed giles i do not know.
I do not have an answer about which version or combination should be used. My installation is back from 2014. You have to try it by yourself.
-
I used the latest version: FLIR Tools+ v 6.3. And that worked fine.
Indeed, download zip file, unzip it and install the software. After install, you need to navigate to: "C:\Program Files\FLIR Systems\FLIR Tools\bin\" and look for the file "FLIRInstallNet.exe".
Run that one and you're good to go.
B.t.w. I wanted a screen protector but didn't find so many suppliers for an Ex serie. If anybody is interested, you can find them here: https://www.amazon.ca/dp/B01HDQPBFW/ref=pe_3034960_236394800_TE_3p_dp_1 (https://www.amazon.ca/dp/B01HDQPBFW/ref=pe_3034960_236394800_TE_3p_dp_1)
-
PIP is now resizeable and moveable 8)
(https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/?action=dlattach;attach=366774;image)
-
Man.. hahaha.. if you keep going, you end up digging stuff up even FLIR doesn't know is there.. 8)
B.t.w. has there been any setting you came across (that could be unlocked) that enables you to turn off the "auto calibration"?
Or set it to "manual" or a user settable "time interval"?
-
Does anyone have a 3.9.0 upgrade pack. I have a V3.5.0 I'd like to liberate.
Previously linked files seem to have expired.
-
Markofq posted it in this thread on page 8.
It seems to be still downloadable:
https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1334948/#msg1334948 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1334948/#msg1334948)
-
I saw that one thanks but neither Chrome nor Firefox will access that link as "Your connection is not secure".
-
I uploaded it for you via WeTransfer (about 18MB): https://we.tl/cZNKdp304m
The download link will stay valid for 7 days, so be on time.. :)
-
Man.. hahaha.. if you keep going, you end up digging stuff up even FLIR doesn't know is there.. 8)
B.t.w. has there been any setting you came across (that could be unlocked) that enables you to turn off the "auto calibration"?
Or set it to "manual" or a user settable "time interval"?
You may be able to turn off autoNUC in the resource tree using rset command, and then use long press of Archive button to trigger manual NUC when you want. If you do not know how to dump and manipulate the resource tree, search E4 Teardown thread for rls,rset,resource keywords.
-
Here is a .FIF I made for the normal E4 that turns off NUC'ing until the camera is restarted. (rset .tcomp.services.autoNuc.active false)
When I am going to record video I power on the camera - run the FIF, leave it connected to the charger for 15-20 min to warm up/equalize, then run a manual NUC by holding the "play" button to level it out.
Then your good to record without calibration popups.
(remember to rename it from .zip to .fif)
-
Just curious. What exactly was done to common_dll.dll that made it so u are allowed to modify conf.cfc?
-
Just curious. What exactly was done to common_dll.dll that made it so u are allowed to modify conf.cfc?
-
I uploaded it for you via WeTransfer (about 18MB): https://we.tl/cZNKdp304m
The download link will stay valid for 7 days, so be on time.. :)
Thanks to you and thanks to Bud. All sorted :-+
-
Here is a .FIF I made for the normal E4 that turns off NUC'ing until the camera is restarted. (rset .tcomp.services.autoNuc.active false)
When I am going to record video I power on the camera - run the FIF, leave it connected to the charger for 15-20 min to warm up/equalize, then run a manual NUC by holding the "play" button to level it out.
Then your good to record without calibration popups.
(remember to rename it from .zip to .fif)
Thanks! I'll save this fif to try it out.
But I think I will follow Bud's suggestion initially, so that I don't have to connect it to the PC to turn off auto calibration.
-
Man.. hahaha.. if you keep going, you end up digging stuff up even FLIR doesn't know is there.. 8)
B.t.w. has there been any setting you came across (that could be unlocked) that enables you to turn off the "auto calibration"?
Or set it to "manual" or a user settable "time interval"?
You may be able to turn off autoNUC in the resource tree using rset command, and then use long press of Archive button to trigger manual NUC when you want. If you do not know how to dump and manipulate the resource tree, search E4 Teardown thread for rls,rset,resource keywords.
Thanks! Will look into this! :)
-
Wow, the hack is already being used for profit on ebay - so sad.
-
Ok, this is a bit far from my skill set and searching an hour on the teardown thread did not bring me much further..
I'm not sure I understand the resource tree thing.
Are Bud and OrBy saying the same thing? Meaning you can only temporarily activate "no auto calibration" just like how you turn the E4 to USB mode using the "FLIRInstallNet" and "Set_RNDIS_temporary.fif"?
Meaning, to activate it you need a PC and after a full restart (>6 sec. ON/OFF button & temporary battery removal) all is back to "normal" mode?
Or is there a permanent way to turn off the auto calibration and 'long-press' Archive/Play to manually calibrate, untill one uses another fif file to undo that?
-
If it is difficult for you then just use the solution OrBy provided. Yes you need a PC but once you upload the fif it takes effect rght away. Some parameters in the resource database have permanent properties, some not. You have to look at the attributes for the parameter, there is no one answers all thing. Flir cameras software is MUCH more sofisticated than one may think.
-
Thanks, I'll try to figure out a 'permanent' solution by strolling the threads later on..
-
Can anybody tell me how to get into the service menu after executing the "Set_RNDIS_temporary.fif" command in the "FLIRInstallNet.exe" and accessing the web browser interface to the E4 by typing 192.168.0.2?
I can't seem to pass by the login screen with "flir" and "3vlig"..
-
I do not think the new stock cameras have service menu in the web interface.
-
It does show the service menu item, but when clicking on it, it requests login data.
None of the login combinations mentioned in this thread worked..
But then how did you access the part where you could access the EEPROM?
-
Have you tried password 1235 ? That WAS the EEPROM password. 2017 cameras may have a new password though.
Tread carefully inside the EEPROM !
Fraser
-
I got my E4 2.0L with stock 3.9 FW.
1, After run FlirInstallNet and upload the temporary RNDIS fif file. (Set_RNDIS_temporary.fif from e4hack3c.zip)
2, Wait for the camera to get IP address assigned as usual, ping 192.168.0.2 and make sure the camera responds to ping.
I tried Win7 64bit and Win10 64bit but the RNDIS mode not working. Network starting but no usable IP. (169.254.96.140 or similar). No responds to ping. :(
Would I be rude to ask if you could post these files?
I'm a newby at this and can find files about hack 2.3.0 (http://fubar.gr/hacking-the-flir-e4/ (http://fubar.gr/hacking-the-flir-e4/)) but not the 2.11.0 and I'm not sure they're the same.. :-[
pull the RNDIS fif files from this zip archive
https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg531346/#msg531346 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg531346/#msg531346)
I recommend only using the Temporary one. You will be in better control over the camera USB interface. The Temporary fif only enables RNDIS until reboot, after which the camera returns to UVC mode. You will perhaps need to run it 2-3 times during the procedure as you reboot but it makes sure the camera will not get stuck in RNDIS using some weirdo IP settings which may give you headache and inability to connect to it. Ask me how I know this.
-
I tried Win7 64bit and Win10 64bit but the RNDIS mode not working. Network starting but no usable IP. (169.254.96.140 or similar). No responds to ping. :(
I've experienced this behaviour quite a few times. Windows or the Flir drivers or both really suck at RNDIS.
Anyway, when such an IP was reported, the camera was still accessible at "add one to the visible IP", say 169.254.96.141 for your 169.254.96.140 example.
I found the other method "connect camera to computer while completely turned off, see the battery charging screen, don't turn it on but apply the .fif" more reliable. The FTP server is then accessible with "anonymous" / no password, way less files locked, no need to telnet and "stopapp".
-
That's awesome! :-+
-
I tried Win7 64bit and Win10 64bit but the RNDIS mode not working. Network starting but no usable IP. (169.254.96.140 or similar). No responds to ping. :(
Try unplugging your computer from the network before running the .fif
-
I tried Win7 64bit and Win10 64bit but the RNDIS mode not working. Network starting but no usable IP. (169.254.96.140 or similar). No responds to ping. :(
Try unplugging your computer from the network before running the .fif
Problem solved:
Without network connection it not works. (Active network device, not need internet connection). I switched on the wifi connenction and everything is ok. :)
Thanks! Good work Bud! :D
-
hi,
i stuck at the beginning. When i switch to RNDIS mode, the connection is look ok, camera has IP 192.168.1.2 but then i receive message in new little window: \\IRCAM8823\images, Information=53, can't find network path (or something like this, message is in my language, so i doesn't know, is translating is right)
-
It is irrelevant, as long as you can connect using ftp you can go ahead.
-
i took back everyting, it's working just great. I have liberated e4 :-+
p.s. i have 8-digit serial, but it doesn't matter,
-
Well, jumped in on an E4 after following this thread, and what do I receive? An 1.2L/2.11 E4. Not what I expected. Apparently the 2016 E4's are still around...
Now I have some questions:
- Is there any reason to prefer the 2017 non-wifi E4 with 2.0 hardware over the 1.2L hardware?
- Will the hack for 3.9.0 also work on the 1.2L hardware?
I'd hate to miss out on all the extra goodies of the 3.9.0 hack... will this be 'backported' in the future?
I'm not sure if it's reasonable to demand a swap for a 2017 version. The one I received came with a completely flat battery, it needed an hour on the charger before any signs of life of the unit.
-
Hi Bud,
Where do we get the extras (Advanced Pack) from? Is it still in development?
Thanks!
-
Well, jumped in on an E4 after following this thread, and what do I receive? An 1.2L/2.11 E4. Not what I expected. Apparently the 2016 E4's are still around...
Now I have some questions:
- Is there any reason to prefer the 2017 non-wifi E4 with 2.0 hardware over the 1.2L hardware?
- Will the hack for 3.9.0 also work on the 1.2L hardware?
I'd hate to miss out on all the extra goodies of the 3.9.0 hack... will this be 'backported' in the future?
I'm not sure if it's reasonable to demand a swap for a 2017 version. The one I received came with a completely flat battery, it needed an hour on the charger before any signs of life of the unit.
I believe they ship the batteries completely dead now due to new regulation with shipping lithium-ion batteries.
-
Hi Bud,
Where do we get the extras (Advanced Pack) from? Is it still in development?
Thanks!
You get it here when it is released. Not yet.
-
... will this be 'backported' in the future?
Sorry we are not running a full time business operation here.
-
hi
I cant connect my flir
I have already done backup, but on the other day I cant connect by filezilla or ever PC cant see it like usb flashcard.
when I plug in flir in PC: ''configuring terma cam... camera ip adress 192.168.1.2... connecting to 192.168.1.2 Please wait...''
Flir E5 fw 3.9.0
-
hi
I cant connect my flir
I have already done backup, but on the other day I cant connect by filezilla or ever PC cant see it like usb flashcard.
when I plug in flir in PC: ''configuring terma cam... camera ip adress 192.168.1.2... connecting to 192.168.1.2 Please wait...''
Flir E5 fw 3.9.0
Try "recovery procedure" https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1336326/#msg1336326 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1336326/#msg1336326) to connect the camera and access files etc.
Or try remove your wired network from the computer before connecting the camera, sometimes rebooting windows before connecting the camera helps.
BEWARE: Bud's package is for the E4 model. Anything else is at your own risk and not supported here, as applying the package to the E4 is at your own risk anyway.
-
MicroBliss - i have the same issue. I just hardreset the cam (unplug the battery for coupple minute), and reconect to usb
Note that after each rebootnig camera, you have to re-run RNDIS mode, then filezilla will have no problem; Or at least I had that :)
-
Well, jumped in on an E4 after following this thread, and what do I receive? An 1.2L/2.11 E4. Not what I expected. Apparently the 2016 E4's are still around...
Now I have some questions:
- Is there any reason to prefer the 2017 non-wifi E4 with 2.0 hardware over the 1.2L hardware?
- Will the hack for 3.9.0 also work on the 1.2L hardware?
I'd hate to miss out on all the extra goodies of the 3.9.0 hack... will this be 'backported' in the future?
I'm not sure if it's reasonable to demand a swap for a 2017 version. The one I received came with a completely flat battery, it needed an hour on the charger before any signs of life of the unit.
I see you're also from NL.
I did get the 2.0L version with 3.9.0 firmware, but my battery also came in flat. Not the best thing for a Lithium battery, unless the E4 has a battery protection feature to completely shut down when it reaches less than 15%.
Either way, if you decide to return this one (wet kopen op afstand) to get a 2017 version, I got mine here:
http://nl.rs-online.com/web/p/thermal-imaging-cameras/8481365/ (http://nl.rs-online.com/web/p/thermal-imaging-cameras/8481365/)
-
MicroBliss - i have the same issue. I just hardreset the cam (unplug the battery for coupple minute), and reconect to usb
Note that after each rebootnig camera, you have to re-run RNDIS mode, then filezilla will have no problem; Or at least I had that :)
Thanks, but didnt help
hi
I cant connect my flir
I have already done backup, but on the other day I cant connect by filezilla or ever PC cant see it like usb flashcard.
when I plug in flir in PC: ''configuring terma cam... camera ip adress 192.168.1.2... connecting to 192.168.1.2 Please wait...''
Flir E5 fw 3.9.0
Try "recovery procedure" https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1336326/#msg1336326 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1336326/#msg1336326) to connect the camera and access files etc.
Or try remove your wired network from the computer before connecting the camera, sometimes rebooting windows before connecting the camera helps.
BEWARE: Bud's package is for the E4 model. Anything else is at your own risk and not supported here, as applying the package to the E4 is at your own risk anyway.
When I Load FLIRInstallNet: Under Camera I should see FLIR USB video, but I see ..."conecting by local net(close to this in english)192.168.0.2". And when i run temporary RNDIS fif file, I see "response_timeout".
-
"\\IRCAM4953\Images
Information = 53
no network path was found(close to it in english)"
perhaps when i did backup i cut folder?
-
Bud, sorry to take up your time with my questions.
But if you have the opportunity, could you look at this:
On my camera I have the following “Measurement” options”
- No Measurements
- Center Spot
- Hot Spot (center spot & hottest spot within the brackets)
- Cold Spot (center spot & coldest spot within the brackets)
- 3 Spots (3 spots next to each other, the middle one like the normal center spot)
- Hot Spot – Spot (center spot & hottest spot within the brackets & ?T between those two)
- Hot Spot – Temp (hottest spot within the brackets & user pre-set Temp & ?T between those two)
When I check your “Basic Hack” files, in the ui.d/presets.d folder, I find these .rsc files:
- preset_centerHotColdSpot
- preset_centerspot
- preset_deltaSpot
- preset_deltaTemp
- preset_fiveSpots
- preset_hotColdSpot
- preset_nomeasure
- preset_threeSpots
- preset_twoHotSpots
Why are not all measurement options showing on my camera?
(Or are they not supposed to yet, but part of the advanced hack?)
I was also wondering, if during your feature discovering journey you have stumbled on a function that can be unlocked to have this feature:
Center Spot & Hottest Spot & Coldest Spot within the brackets
and :
Either be able to resize the brackets, or have them cover a larger area than they are now with the “Hot Spot” and “Cold Spot” functions?
And if not, would it be possible to adjust the text in the .rsc files to construct my own preset and just (re)name that to for example “preset_threeSpots”, since I won’t be using the “threeSpots” function?
Or are these .rcs files not adjustable this way and need their operation be facilitated in some other part of the software?
Other thing I was wondering is about the autoNUC.
Although OrBy’s method of (temporarily) disabling the autoNUC function by means of running the .fif file works, sometimes the camera freezes and I have to (hard) reset it (by holding the ON/OFF button 6 seconds and removing the battery for a few seconds). Then the camera looses this feature and autoNUC is back at it..
When this happens while I’m away from my PC, I can’t get it back.
Some camera’s, like the WIRIS Gen 2, allow you to change the autoNUC mode in the settings menu, where you can choose between “auto”, “every 1 minute”, “every 5 minutes” and “manual”.
Have you come across such similar function or feature while discovering and unlocking the E4 possibilities?
-
Conected by "Recovery procedure" (user: anonymous, pass: NcFTP@ ). Load bakup. Didnt help.
"\\IRCAM4953\Images
Information = 1231
network folder is not available(close to it in english)..."
-
Conected by "Recovery procedure" (user: anonymous, pass: NcFTP@ ). Load bakup. Didnt help.
"\\IRCAM4953\Images
Information = 1231
network folder is not available(close to it in english)..."
Sorry, didn't give you full instructions: Use "Recovery procedure" to connect, do not upload backup now but rather apply the patches then as written, you can probably skip the part with telnet and stopapp.
Ignore the messages about "\\IRCAM4953\Images "
Based on my experience that RNDIS connection to the camera works more reliably on my PC when initiated like "recovery procedure" than in "normal mode". Both give access to all the files you need to upload to apply the patches.
-
I uploaded the three spot fix (check post #218)
Place the downloaded file in /FlashBFS/system/ui.d/presets.d/ and it should work for you. Make sure you backup the old file before replacing it.
-
Conected by "Recovery procedure" (user: anonymous, pass: NcFTP@ ). Load bakup. Didnt help.
"\\IRCAM4953\Images
Information = 1231
network folder is not available(close to it in english)..."
I've already told you this message is irrelevant to the liberation procedure. Not sure why you can't pass your concern. If you want to get it working then please do not post it here and open another thread.
-
Why are not all measurement options showing on my camera?
(Or are they not supposed to yet, but part of the advanced hack?)
There are things other than just the config file that affect that. Advanced package does not add anything there.
And if not, would it be possible to adjust the text in the .rsc files to construct my own preset and just (re)name that to for example “preset_threeSpots”, since I won’t be using the “threeSpots” function?
Or are these .rcs files not adjustable this way and need their operation be facilitated in some other part of the software?
I did not try to adjust but it should work, the rsc files with the box tool should have the box dimensions definef in the rsc, just give it a try.
Some camera’s, like the WIRIS Gen 2, allow you to change the autoNUC mode in the settings menu, where you can choose between “auto”, “every 1 minute”, “every 5 minutes” and “manual”.
Have you come across such similar function or feature while discovering and unlocking the E4 possibilities?
No i have not seen such feature in the menu.
-
I just became the owner of a FLIR ETS320. It is basically an E8 chassis in a desk mounted inspection role.
Looking at the video reviews it appears to be loaded with firmware 3.50. Whilst it is already 320 x 240 pixels displayed, I suspect the noise generator is still present and doing its filthy work to degrade the image. The available menu options are also a little limited.
I think I will have to install firmware 3.9 and have a play with the E4 upgrade to see if I can customise the ETS320 a little :)
It will take a couple of weeks to arrive with me, but in that time I can study the latest upgrade approach and see if it will work with an E8 chassis.
Fraser
-
My Flir E4 non Wifi model 2.0L firmware 3.9.0.
can I Resolution and Menu Hack Thread ,
Is there a way so I can upgrade Flir......?
-
Read this post:
https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1336326/#msg1336326 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1336326/#msg1336326)
It's been tested and working on non-Wifi models too.
-
Thanks for taking the time to answer my questions Bud! :)
Why are not all measurement options showing on my camera?
(Or are they not supposed to yet, but part of the advanced hack?)
There are things other than just the config file that affect that. Advanced package does not add anything there.
But if 'only':
- preset_deltaSpot
- preset_deltaTemp
- preset_threeSpots
are usable, why did we also have to copy:
- preset_centerHotColdSpot
- preset_fiveSpots
- preset_hotColdSpot
- preset_twoHotSpots
into the "ui.d/presets.d folder"?
Or are those functions that, if we were to rename them to a 'slot' we don't need (for example rename "preset_fiveSpots" to "preset_threeSpots") would enable us to have that function?
Would it not be possible to get a 'double row' of options, much like the color palette options?
-
My Flir E4 non Wifi model 2.0L firmware 3.9.0.
can I Resolution and Menu Hack Thread ,
Is there a way so I can upgrade Flir......?
Yes! :)
I have a non-WiFi E4, model 2.0L and firmware 3.9.0 and it works.
-
To whoever is interested:
Apparently, there are only 7 'slots' available for the menu item "Measurement".
Therefore if you want a new/different function, one has to sacrifice an existing function by renaming the desired function to the sacrificed one.
I've decided to utilize the "preset_threeSpots.rsc" function
This is a 3 Spot temperature measure function (3 spots close next to each other) without a way to move these points.
I had no real use for this function.
Instead I preferred to have the "preset_centerHotColdSpot.rsc" function, which shows this:
(Center) spot temp
Hottest spot in the box
Coldest spot in the box
So I renamed "preset_centerHotColdSpot.rsc" to "preset_threeSpots.rsc".
I also modded the .rsc file so the box size within which the hottest and coldest are displayed is larger.
NOTE: Make sure you backup the original "preset_threeSpots.rsc" file, in case you want to revert back to this measurement function!
Make a connection to the PC via the usual way and connect to the camera via FTP.
Overwriting the existing "preset_threeSpots.rsc", the included "preset_threeSpots.rsc" file should be copied to:
\FlashBFS\system\ui.d\presets.d
(edit: added sample picture of this preset.)
-
My E5 2.0L fw 3.9.0 without Wi-Fi has hacked, but it complicated conect to PC. It need nard reset to Flir and reset PC, and only by FTP.
Also when turn on Flir I see that "This device has unseported softwear...", but it works.
Thanks Bud
thanks all
How can i see that resolution has changed?) Images before had 320x240, and after 320x240.
-
Also when turn on Flir I see that "This device has unseported softwear...", but it works.
How can i see that resolution has changed?) Images before had 320x240, and after 320x240.
The message is added on purpose by Bud's hack, to indicate the camera doesn't run official firmware.
Make a snapshot, the view the snapshot with the camera, look into details, somewhere it says "Thermal resolution", that should indicate 320x240 now.
-
... will this be 'backported' in the future?
Sorry we are not running a full time business operation here.
Of course, I understand that this is something you have spent a lot of free time on and your effort is very much appreciated. I'm not asking you to do a backport, it's your free time and you should spend it as you please.
What iI was asking is if it would be a reasonable assumption that with some extra effort this could be done, or that it cannot be done because of, for example, some blocking hardware difference.
I'm also trying to figure out if the Flir E4 2.0 hardware is an actual improvement over the 1.2. The 1.2L can also be patched to firmware 3.9.0 if i'm not mistaken, so I figured that the 1.2L hardware might eventually also be supported on firmware 3.9.0.
For the RNDIS connection, I had to manually set the IP and gateway to be able to connect. auto configuration is very unreliable, it only worked once out of 20+ attempts.
edit:
.calib.nrdp.ds250C_we_ap_fi_le.measureInfo.temporalMk double 13.196414
That's an ok noise figure I guess :)
-
My Flir E4 non Wifi model 2.0L firmware 3.9.0.
Is this a success?
Power on the camera and see if you now have 320x240 resolution working. <=== step 15 , I see is 80x60 , how to I check resolution
I skipped the step 15 and proceeded to step 16. Now the resolution shows 320X240 by itself without me editing anything. Did I succeed in the hacking?
(https://i.imgur.com/6ABJx4c.jpg)
(https://i.imgur.com/QEehcVd.jpg)
-
@ Summer:
Yes, your hack was succesful! :)
Step 15 is not really a step you have to do. It is more a check if the hack worked so far.
And it did. Both your resolution and the options you now have to select different color pallets, confirms that.
-
Of course, I understand that this is something you have spent a lot of free time on and your effort is very much appreciated.
You know, I should take a moment to echo this, and add my gratitude as well. For Bud specifically, but also for the whole rowdy bunch of hackers in here. And for the folks at Flir who continue to put such top-end hardware into a nice affordable little package! :-DD
I ordered my E4 Wifi just before the upgrade package was published, so that actually happened while my unit was in transit. It arrived, and within minutes (after letting the battery charge), I was able to unlock all this additional functionality without a hitch, following exquisitely detailed directions, from a clever fellow who put a ton of time into this, standing on the shoulders of a truly insane thread where a bunch of other clever people put a ton of time into the last hack.
Without these developments and the downward price-pressure they exerted on the whole market starting in 2014, I think reasonable-quality thermal imaging would still be out of reach for a great many of us. Now there are several good options, and we as hobbyists have never had it so good.
I think for every noob who finds the Post button more convenient than the Search button, and for every scumbag profiting from this hack on fleaBay, there are countless more of us quietly enjoying the fruits of Bud's labor. (And hopefully doing even more cool stuff with the time we saved not having to do this one from scratch.)
:-+
-
@ Summer:
Yes, your hack was succesful! :)
Step 15 is not really a step you have to do. It is more a check if the hack worked so far.
And it did. Both your resolution and the options you now have to select different color pallets, confirms that.
Thank you very much
-
How does the update work from Bud to flir e4 without wifi? or are there any problems?
-
How does the update work from Bud to flir e4 without wifi? or are there any problems?
Read the freakin' thread, it has already been said a dozen times. Can't be that hard to go through the last few pages.
Btw wanted to tell my gratitudes to Bud, everything worked for me too.
Also thanks to Squawk for the center+hot+coldspot preset.
-
BUD!
MANY THANKS for the great WORK!!!
Flir E4 without wifi works!
p.s. don't use win8.1
-
does anyone have the first numbers of the serials for E4/E5's with wifi? (so first 3-4 numbers of serial?)
thanks in advance :)
-
BUD!
MANY THANKS for the great WORK!!!
Flir E4 without wifi works!
p.s. don't use win8.1
Why do you think i use 8.1 ?
-
does anyone have the first numbers of the serials for E4/E5's with wifi? (so first 3-4 numbers of serial?)
thanks in advance :)
wifi units started around 63997xxx
-
Hi,
just for info to other people with win 8.1
i tryed it with win 8.1 and it didn't work properly. So i made it with a VM and win7 without problems...
Thanks!
BR anton
-
My Flir E4 non Wifi model 2.0L firmware 3.9.0.
Is this a success?
Power on the camera and see if you now have 320x240 resolution working. <=== step 15 , I see is 80x60 , how to I check resolution
I skipped the step 15 and proceeded to step 16. Now the resolution shows 320X240 by itself without me editing anything. Did I succeed in the hacking?
(https://i.imgur.com/6ABJx4c.jpg)
(https://i.imgur.com/QEehcVd.jpg)
I see that the digital resolution is 320x240 for hardwareversion E4 2.0.
For my E4 1.2L I think this is 640x480.
Or am I wrong?
Did Flir downgrade the hardware?
-
I see that the digital resolution is 320x240 for hardwareversion E4 2.0.
For my E4 1.2L I think this is 640x480.
Or am I wrong?
Did Flir downgrade the hardware?
I was wondering the same thing, I believe the old ones were indeed 640x480.
-
My archieved photos say 640x480 for digital resolution, I'm sure. ;)
-
Read the datasheet, it says 640x480 for the digital camera.
-
So the hack reduces the Original digital camera resolution from 640x480 to 320x240?
Is it possible to adjust the hack in a such a way to get the digital camera resolution back to 640x480?
-
With regard to visible camera resolution, it is not uncommon for the visible light image to be cropped and downsampled to match the thermal image when a 'dual image' save is active. This is done to simplify image comparison and even Image Fusion. The image you have provided details of was a dual image save.
Try taking a 'visible light only' image and check its resolution. The E4 camera is 640 x 480 pixels but what is saved depends upon how the E4 is configured. Visible light camera resolution can be set by a configuration line in the configuration file on earlier E4 cameras
Fraser
-
Thank you for your insight Fraser, you sure are a living IRpedia! :)
Indeed as you described, it is a setting thing.
When one goes to: Settings - Save Options - Photo as seperate JPEG: and choose "ON", it will save the digital camera photo as a 640x480 JPEG file.
But when this option is set to "OFF", you will have the digital photo resolution of 320x240, as shown in Summer's screenshot above.
This is regardless of the "Digital Camera" only setting in the "Image Mode" option in the main toolbar (menu button press).
Strangly though, in this "Digital Camera" (only) mode, it makes the first photo (that would normally be an IR photo) in 320x240, but the (second) photo (that would normally be the visible camera photo) in 640x480.
-
That is a difference between the E4 1.2L FW2.3 en E4 2.0 FW3.9 because the setting of the imagemode option doesn't matter for the E4 1.2L. Digital resolution is always 640x480 in the archieved photos.
-
So the hack reduces the Original digital camera resolution from 640x480 to 320x240?
It has nothing to do with digital camera, it only unlocks the config file which then can be edited to E8 configuration.
-
That is a difference between the hacked E4 1.2L FW2.3 en E4 2.0 FW3.9
You should not be using the "hacked" word until you compare the stock cameras. If the stock WiFi camera shows same information, you should ask Flir why they changed it. To find out you can roll back the mod (see recovery procedure on page 8 ) or ask someone here who has not applied the mod yet to check what their stock camera says.
-
Yes, I understand and you are right, Bud. It will be a stock change by Flir and has nothing to do with the hack.
I first wonder why they make the change. My first thought was a hardware change but Fraser did explain it very well, I think.
By the way, I’m glad to ‘see’ you are back for this hack. Three years ago you did already some very good magic work together with Janekivi for the E4 1.2L, that I own. I tested at the time for Janekivi.
I wonder if the possibilities will be more than at the time. I already saw the new medical.pal you found.
Keep doing good work, Bud. :-+
-
Hello all,
I would like to ask you is it possible to buy new E4 with or without wifi that is possible to hack to 320x240 E8? Is there any E4 that cant be hackable? Or if I get newer firmware than 3.9.0 is only limitation?
I would like to buy on ebay or amazon, can you help me? Many thanks dear comunity! :-+
-
see Reply #325
Hardware 2.0L
Firmware is upgrade or downgradeable (i think)
BR a.
-
Yes, I understand and you are right, Bud. It will be a stock change by Flir and has nothing to do with the hack.
I first wonder why they make the change. My first thought was a hardware change but Fraser did explain it very well, I think.
No worries. 640x480 is still there, as was shown in the screenshot here:
https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1326599/#msg1326599 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1326599/#msg1326599)
You can see what the embedded image information says in the right pane.
Also, take any E4 image and run this exiftool command:
exiftool.exe -b -embeddedimage flirXXXX.jpg >test.jpg
You will get the 640x480 digital camera image in test.jpg
-
Bud, great work!
I had E4 1.2L, but, after malfunction, service Flir replaced to new 2.0L. I used for half a year with degraded resolution. Now is great again. :)
Two question:
1. How can I remove record menu from toolbar?
2. How can I remove splash screen with "This device is insupported...."
Thanks for your reply.
-
1. Edit toolbar-config.xml , find that line and comment it out or remove
2. You will have to live with it, it is a very small price to pay
-
Bud, would it be possible to edit the config file in such a way, that in the "Menu button - measurement options", we would get a 'double row' of options, much like the color palette options?
This way we could have a 'slot' for all available items.
Or would it take more than just editing the config file?
-
If you think that not all presets are displayed because of space limitation in the menu bar then this is not the case. Presets names are hard coded, you cant add arbitrary ones. The software decides which ones to display, the logic is unknown.
-
Bud, thank you for the hack!
can i send you a donation for a pack of beer?
-e4 non wifi-
-
Ah, oke.. thank you for clarifying!
Too bad though.. ;)
-
I'm a bit surprised. There are 154 downloads of Bud's hack, yet there are only 10 "thank you's" in the post bar and less than 20 "thank you" posts..
Where are the other 124??
Very small effort imho.
-
Just FYI for Flir UK Black Friday - massive discounts - E4 Wifi with car charger and pouch - £699,- incl VAT. E6 is <1000
http://www.flir.co.uk/instruments/bf2017/ (http://www.flir.co.uk/instruments/bf2017/)
-
Hello...first post here!
I've been reading this thread as well as the huge amount of other info on the E4 hack elsewhere on the forum and obviously come away impressed with what can be done with a "cheaper" device. I'm in the market for a cheap thermal imaging camera for general lab and PCB diagnostics and the E4 (+hack) looks ideal - the question is where can you buy it? I'm based in the UK and the only place that I can find that has the E4 Wifi version is direct from FLIR (as also indicated by the above post - for a great price!). Does anyone know if this model will ship with the appropriate hardware + firmware to apply the hack?
Lastly, has anyone tried to do this on a Mac? I cannot see an issue with the wifi method since it just requires python and putty to modify and upload the files, all of which can be done in terminal and with a text editor.
-
I'm a bit surprised. There are 154 downloads of Bud's hack, yet there are only 10 "thank you's" in the post bar and less than 20 "thank you" posts..
Where are the other 124??
Thank you my friend. It's allright, the award was overcoming a technical challenge, not getting recognition.
-
Pjuk,
Cameras that come direct from FLIR usually come with the very latest firmware. FLIR do not seem to hold large stocks so they are often fresh from the factory with calibration dates from a few weeks before delivery to the customer. Older stock is sometimes to be found from sources such as Amazon or provincial dealerships.
My understanding is that the latest firmware 3.12 IS NOT compatible with Bud's clever upgrade. I do not know whether a downgrade to firmware 3.9 is possible. Such carries the risk of bricking the camera so needs due consideration.
Fraser
-
Thanks for letting me know without me finding out the hard way! Maybe I'll just stick with a non-wifi version for now, although the wifi would be very useful. Shame no-one knows about downgrading from 3.12 to 3.9
-
Hi,
got my E4 no wifi with 2.0L and 3.9 FW two weeks ago from messgeraete-chemnitz.de
wrote a mail befor to check if the E4 has the right hardware 2.0L, price was 775€
Calibration was in October.
so ask for a E4 with calibration in Oktober.
hope this helps
BR a.
-
Really wanted to avoid problems, and I followed Bud's steps slowly and to a T (really, the steps were easy), but now I get banding on the screen like the thermal sensor is broke or something. I have attached a screenshot of it with the shutter closed below.
The resolution hack went well with no issues (confirmed higher res) then I proceeded to apply the menu hacks at step #16. Rebooted E4 as suggested and then started playing with the new settings. The issue started popping up around the time I was messing with the different pallettes and the hot/cold spots.
At this point, I'm like "whatever, these other settings are nice but I don't really need them." I copy over my original menu files from my backup and again restart the camera. However, the problem now persists even with the original menu. At this point I start freaking out a little (and still am), so I decide to do a factory reset. No go. At this point I'm like there must be a bad config file somewhere so I decide to copy over ALL my original backup files to the E4 in hopes of resolve the issue. Issue still persists :|
So, any suggestions? I really don't know what's wrong. Maybe my issue is that I tried applying all the new menu settings?
Model E4 2.0L
Software 3.9.0 (camera came with this version)
PN 63906-0604 (wifi model)
EDIT: Decided to use the FLIRInstallNet.exe app with previously-posted E4 3.9.0 .fif file to see if I could get it as close to stock as possible. Reimage (I think that's what it would be with this tool) completed but after reboot I see the same behavior. Perhaps this E4 was not capable of running at 320x240 for some reason or I have a defective unit?
-
I see the screenshot you attached has 320x240. Is this after you tried to restore from hacked state? Or before?
I had one hack try failed as well. Not with your reported problem, but I also had some strange things.
In my case, I literally reversed every step from the hack.
I deleted every file copied during the hack (all steps in reverse order) and copied back the original respective files from the backup I made.
Including putting back the original config file as the last reversed step. (I did not try to copy back the complete backup, just the files replaced in the hack steps.)
Then did a hard reset (holding the ON button for 7 seconds and removing the battery for 5 minutes).
This got my E4 (non WiFi) back to its original state, resolution and menu structure.
If you get to this point and the screen is still messed up, I can't think but the problem lies in your hardware having a failure somewhere.
Also, I think if you get to this point, there should be no trace in the E4 that would alert a FLIR repair service person you tried to temper with it by installing a hack.
And you could choose to return it (we have a 14 day money back guarantee in Europe, not sure if you have such a thing in the US), or send it back in for repair.
Be aware though, there is a new firmware out (3.12) that the hack does not seem compatible with. Chances are, that if you send it back for repair and get it returned, they put firmware version 3.12 on it.
I hope this is of any help for you..
-
Thanks for the reply. Every little bit helps.
Good catch on the 320x240 in the screenshot. I can confirm though that the camera says that pic is 80x60 thermal resolution and 320x240 digital. Looks like the camera just upscales the thermal image to the digital resolution.
Also, really interesting is that today, after leaving the camera battery unplugged overnight, I no longer get the banding. :-//
/Very confused. Perhaps the sensor was overheating or overvolted somehow?
-
I redid just the basic hack (no menu's from step 16) and everything starts off well. After about 5-10 minutes, the banding re-appears. Attached are pics of thermal 80x60, 320x240 initial, 320x240 after 5 minutes, and 320x240 after 10 minutes for comparison. I'm going to venture the sensor is bad? Next testing I do will be reverting to 80x60 for a long term test.
-
Thanks for sharing your findings.
Reversion back to pre-hack and doing a long term test may indeed point to a hardware failure somewhere.
Good luck!
-
I'm going to venture the sensor is bad?
I think, your sensor is good but you have serious trouble with your flat-field correction (FFC).
Does your shutter work?
The row and column noise is not compensated by uniformity correction.
PS: I love the distortion correction by FLIR in RAW images :-DD
$ exiftool FLIR0010.jpg -b -RawThermalImage > FLIR0010.png
$ convert -define png:swap-bytes=on FLIR0010.png -auto-level FLIR0010a.png
(https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/?action=dlattach;attach=376196;image)
-
how do i reset a photo counter?
-
Just connect the camera as USB stick and delete ALL files/folders on it.
After a reboot, factory reset and delete all images through the menu, the counter starts at 1.
Of course, make a backup before you delete anything.
regards
-
Regarding deleting images to reset the image counter. From other posts in this forum you will see that it is a very bad idea to format the cameras image memory area. Never be tempted to do so as a short cut to deleting all images.
Fraser
-
Is it possible to make a resolution of 160x120? I think for my e4 it will be better.
-
Den-teh,
Why would you want 160 x 120 pixels when the E4 is calibrated and capable of 320 x 240 ?
The natural resolution of the cameras LCD display is also 320 x 240, a perfect match for the full microbolometer resolution.
Fraser
-
still a problem. on the street -3, and he shows -10 ((
-
From other posts in this forum you will see that it is a very bad idea to format the cameras image memory area. Never be tempted to do so as a short cut to deleting all images.
I haven't seen that information before, or I've forgotten. And there's no way I'm going to work out where I left off the other thread and resume reading.
Is this just a simple thing of Winblows not being able to format to the same type of filesystem that's on the camera?
-
Hi Apelly,
It is a new thread that is currently discussing the issue.......
https://www.eevblog.com/forum/thermal-imaging/flir-e4-'there-is-no-memory-card'-error/ (https://www.eevblog.com/forum/thermal-imaging/flir-e4-'there-is-no-memory-card'-error/)
Another thread also details the same problem after doing a format of the cameras picture memory.
I have no information on what causes this situation, but suspect that the PC instigated format overwrites something unique and important in the flash memory area. The cameras firmware then effectively loses sight of the Flash memory so no pictures can be stored.
This has happened to other users in the past and has required 'repair' by FLIR as no one knew exactly what was wrong or missing from the Flash memory area.
In the above referenced thread I have made some basic comments in an effort to help diagnose the cause of the problem, but sadly I am no expert on the Ex series firmware inner workings.
Formatting a flash drive should not cause serious harm to the operation of the camera, the fact that it does is unacceptable as users can, and do, format flash drives in everyday life. FLIR have messed up here.
Fraser
Fraser
-
Hello together,
I got a Flir E4 with Firmware 3.1.2 so I used the 3.9.0 upgrade package and downgraded the firmware with NO issues.
Now I will try Buds method for upgrading...
-
worked 75%, but some of the small pics in the menu are missing, but the menu is FULL functional.
Just the pics are missing...
-
Do you know if this could possibly work for the WiFi version?
-
Bud,
Thank you very much for your efforts and the time you spent on this project.
You did a great job.
I just performed the upgrade on my brand new E4 non wifi 2.0L. To be honest I had some difficulties but I was finally able to figure it all out by reading several of your posts here and there.
So Yeap, just posting to say thanks and would like to buy you a beer or something in return so let me know if you accept donations.
Cheers
-
Thank you my friend. You still may not have the job complete, there should be no manufacturer logo in a properly liberated system.
-
Thank you my friend. You still may not have the job complete, there should be no manufacturer logo in a properly liberated system.
you are right, photo is during the difficulties I mentioned where the resolution was upgraded but I have done something wrong with the conf. ::)
The only problem I now have is the alignment images in MSX mode when shooting close ups. But I found some posts on calibration so I am working on it! Thank you again!
-
Just in case my post on a 2017 FW3.5 / HW2.0L Ex chassis issue is of any interest to readers of this thread....
https://www.eevblog.com/forum/thermal-imaging/flir-ex-chassis-ets320-interesting-'fault'-may-apply-to-e4-e5-e6-e8/ (https://www.eevblog.com/forum/thermal-imaging/flir-ex-chassis-ets320-interesting-'fault'-may-apply-to-e4-e5-e6-e8/)
Fraser
-
So, I don’t have a Flirinstallnet in the program files/flir systems folder. I don’t even have a FLIR Tools folder there. I’m on FLIR tools 6.4. Doesn’t seem like they would change it. I can do the ctrl-shift-alt deal and click on the camera on the update screen to select the fif file to use but if I do that on the rndis temporary fif it then asks what version of eFLIRinstall to use and I can’t find it.
-
Hello together,
I got a Flir E4 with Firmware 3.1.2 so I used the 3.9.0 upgrade package and downgraded the firmware with NO issues.
Now I will try Buds method for upgrading...
Incedentally, I did the same on my new from FLIR E4 as well. That part worked just fine.
-
So, I eventually deleted FLIR Tools and installed an older version I found and it Installed FlirInstallnet.exe, so I was able to get it working.
Thanks. Loving these changes just playing around for 5 minutes!
-
Hello together,
I got a Flir E4 with Firmware 3.1.2 so I used the 3.9.0 upgrade package and downgraded the firmware with NO issues.
Now I will try Buds method for upgrading...
Can this be used for the E4 w/WiFi model?
-
Hello together,
I got a Flir E4 with Firmware 3.1.2 so I used the 3.9.0 upgrade package and downgraded the firmware with NO issues.
Now I will try Buds method for upgrading...
Can this be used for the E4 w/WiFi model?
Worked for me. Evidently they don’t do any checking to see if the new version number is higher than current.
-
Firmwaredowngrade from 3.12.0 to 3.9.0 worked with Flir Tools 6.4 (was not possible with older Flir Tools 5.0) as well as the described steps from Bud to patch conf.cfc and replace common_dll.dll on a non-WiFi Flir E4 2.0L - thanks man! :-+ I just needed the resolution enhancement, so I have not tested the pallette files etc.
-
After doing 1 big mistake, i guess the latest flir 6.4xx was blocking the log in by name.
Its my birthday today i coud never have better gift after done the fix :-+.
Thanks to all, and noob :-+ !
Always funny with pictures.
-
Advanced update package for E4 2.0L WiFi fw v3.9.0
DISCLAIMER: YOU PERFORM THIS UPDATE AT YOUR OWN RISK
Christmas 2017 is approaching fast. Good news to my fellow E4 fans: Santa has just dropped by and here is your long wished Christmas present: the Advanced Liberation Pack for the E4 2.0L fw v3.9.0.
You have to have the Basic Liberation Package (https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1336326/#msg1336326) installed first, if you have not yet. Then apply this one on top of it.
Take a backup copy of your camera before applying the mod. You will need it to roll the change back in case of problems.
With the mod in place you should NOT apply firmware updates published by the camera manufacturer. Such updates may overwrite critical files and the camera may stop working. If you want to apply such update you first have to remove the mod and return to the stock configuration.
The mod is provided for your personal use. In case you need to sell the camera, please roll the change back to the stock firmware. There will be a quick splash screen at startup reminding you of that. If someone, who is not aware of the said condition in the previous paragraph, buys the mod-ed camera from you and applies a manufacturer firmware update, the person will end up with a bricked camera. Please be considerate and do not do that.
This update was made for and using E4 2.0L 3.9.0 WiFi version device. It has not been tested on a non-WiFi device, though my thoughts are it should work with it too. You will have to use USB and RNDIS mode to apply the update to non-WiFi camera.
Please report errors/omissions in the installation instructions in this thread, and share your success (or fail) stories.
'=====================
Edit: Some people asked how they can donate. Thanks everyone for your kindness, here is a few cryptocurrency addresses:
Bitcoin:
19zxE1RPm2bX3AmyUAkPEB2iyyCUUVRPmg
Ethereum:
0xb9Bf7301ffB58c1d1D3fAc951F888dC9Bdd1410d
Ripple:
rBo5NVTka69dtnKYvZp3tMEY35yMLK44Du
'=====================
Update: Liberation Package for E4 2.0L fw v3.12.0 is here (https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1397359/#msg1397359)
Update: CommonDLL for E4 2.0L fw v3.16.0 is here (https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg2252082/#msg2252082). Except for this file, use the package from v3.12.0 to liberate v3.16.0
Update: So far the following FW versions confirmed working: 3.9.0, 3.11.0, 3.12.0, 3.13.0, 3.16.0. They may use different packages, you need to scan this thread for information and attachments for a particular fw version.
-
Many thanks and happy christmas.
On quick test the non-wifi 3.9.0 is working fine, many new things.
Little early to post this:
The medical pallet is missing on the camera (got 12 different).
I did copy the system map at once.
I will check after next dinner brake, recopy or whatever. preset_screening.rsc
-
Ah, the stock WiFi version includes the medical palette. OK i will add it to the package for non-WiFi owners.
-
The Advanced package has too many features and may be overwhelming. But for experimenters it can be goldmine for the price, because some of the features only available in $10K price range Flir cameras.
To help learn it, download the Flir Exx series user manual which has chapters on working with Isotherms, Images annotations, Time-lapse, Screening alarms and more.
http://support.flir.com/DocDownload/Assets/dl/t810190-en-us_usl.pdf (http://support.flir.com/DocDownload/Assets/dl/t810190-en-us_usl.pdf)
Note: Where the manual refers to the Programmable button, on your liberated E4 (Basic or Advanced) it is the Back button.
Also, there is no touch screen on the E4, so the procedures that use touch do not apply to the E4.
Some of the features in the Advanced package have been synthesized by your servant and may not exist in the exact implementation in any of F cameras. Those ones I will explain separately.
-
Thank you for the Advanced Enhancement package Bud!!! :D
Have a great Christmas!
-
Known limitations:
In the Settings menu the following parameters are read only:
- Relative Humidity
- Atmospheric temperature
- Window compensation (can only be switched On and Off, but can't be adjusted)
(https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/?action=dlattach;attach=381815;image)
To adjust these parameters, use the popup menu. To access the popup menu press Up button when in live image mode:
(https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/?action=dlattach;attach=381817;image)
"Distance" parameter refers to the distance to the object. It slightly affects temperature readings, so for best accuracy set the Distance parameter properly. This parameter can be set in both Settings and Popup menu.
(https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/?action=dlattach;attach=381821;image)
"Alignment Distance" parameter is the MSX alignment distance which affects alignment of the thermal and visual/MSX images, and is equivalent of the same parameter in the Popup menu.
But
In Popup menu the range of settings is 0.3-3m with progressive increment. Whereas in the Settings menu the range is 0.1-1m with 0.1m increment, which allows for closer MSX then in the stock camera, as well as allows for finer adjustment of MSX within first 1m range. For longer MSX distances use the Popup menu.
The finer MSX Alignment distance allows to inspect PCBs in MSX mode closer than with the stock camera.
(https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/?action=dlattach;attach=381823;image)
When using Alignment distance, make sure to actually change and press Select button, because this parameter is displayed individually in each of the menus (Settings or Popup) so it may be confusing, e.g. the Settings menu may say it is 0.1m but the Popup menu says it is 0.6m.
-
Adjusting Picture-in-Picture (PIP) window:
- Select PIP mode. A floating message at the top of the screen will tip you to press and hold the Down button if you want to change PIP size or position (screenshot 1).
- Press and hold the Down button. The PIP window will change to bonding box and the "move" icon will appear in the right top corner (screenshot 2). Use the cursor buttons to reposition the PIP box.
Note the floating message at the top changed, helping you with tips which buttons to press. - If want to resize the box, press Select button. The "move" icon will change to "resize" icon (screenshot 3). Use the cursor buttons to resize the PIP box. Left/Right will change horizontal size. Up/Down will change vertical size.
- If want to re-adjust the position, press Select button again. This button will toggle between PIP Move and Resize modes.
- When satisfied with adjustment, press Back button to exit PIP Edit mode. After that, if want to re-adjust PIP, again press and hold the Down button (screenshot 4).
(https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/?action=dlattach;attach=381828;image)
Known limitation: the camera does not store custom PIP size or position. If you exit PIP mode, next time you select PIP mode it will start with the default PIP size and position defined in the PIP preset file in the file system.
-
Turning the Screening mode on and off:
(https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/?action=dlattach;attach=381830;image)
When Screening mode is turned off in Main Settings menu, there will be no icon for it displayed.
(https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/?action=dlattach;attach=381839;image)
Only the high end cameras ($20,000-$40,000) have this feature. Now available in E4 with help of your servant 8)
-
Sport mode:
(https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/?action=dlattach;attach=381833;image)
It is not known what the Sport mode does. However it was required to unlock the Medical palette. It is possible that this mode may set particular parameters in the thermal sensor, possibly to reduce frame capture time and/or change exposure in order to produce better images of moving objects, but I do not know and was not able to find any information. Searching Flir camera datasheets I could only find one particular camera model that had that mode, and that was a special model for the medical industry. So very specific tests have to be performed to understand if the mode has any specific characteristics or is only a marketing element. Thanks for the Medical palette anyways.
Tip: If you do not want the Sport mode in the menu, you can turn it off by editing the toolbar-config.xml file. Search for the "sport" word and remove the whole line which has it.
-
External IR Window Compensation mode:
(https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/?action=dlattach;attach=381837;image)
For use cases information see this post from Fraser:
https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1333991/#msg1333991 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1333991/#msg1333991)
-
Many Thanks Santa Bud!!
:-+
BR a.
-
I am getting really jealous wit all the features.
Too bad that the flir firmware won't do on Android - but in theory it should be possible to build all of those features into a custom Android app for flir ONE/ Cat S60
-
Bud, I have been trying to contact Thermal Experts to inquire about their camera, with your new update package, I just ordered the New E4 with Wifi, I am pretty excited.
Once I get home I will send you a donation because I appreciate people spending their valuable time helping others.
Can't wait to get home from the Holidays and use this in the lab and shop
-
Bud, really awesome stuff!!
So happy with the parameters popup window! :-+
-
Time Lapse mode.
Set a number of shots you want and the camera will take them separated by the specified time interval. Minimum interval is 15 sec . Images are saved as separate files with the usual naming convention.
(https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/?action=dlattach;attach=381928;image)
-
Image Editing features available in two flavours:
1. Edit in the Archive
Edit measurements: Select an image in the Archive and select Edit. You can then change all usual parameters as in Live view and more. You can add more measurement tools such as Spots, Boxes, Circles, Lines and Deltas. You can move and resize them, add and delete them as you wish. As well as you can change the visual mode (Thermal/MSX, PIP etc), change palettes and temperature scale mode (Auto/Manual). In the sample image provided below I added moved the Spot, added a Line, a Circle and a Box (which I also resized). The Line tool (the dashed line in the image center) produces a curve that shows thermal gradient along the Line, which is a white solid line at the image bottom.
The black background in the Edit mode is because the screen capture tool that I used did not show the image, only the tools. When you will use this feature you will actually be seeing the actual image as the background.
(https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/?action=dlattach;attach=381931;image)
Adding a Sketch: Select an image in the Archive and select "Add Sketch". This mode exists in Flir touch cameras and was made for touch, so I had to selectively remove some features and only leave the ones that can be used with the keypad. First select the Pen color, then you can add Left and Right Arrows and Circles. You can move them to the desired location on the image. Same as in Tools Edit mode, you will be seeing the actual image as the background, so it will be easy to position the Sketch tools. The resulting sample image after saving the changes is shown in the right bottom in the following screenshot series:
(https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/?action=dlattach;attach=381933;image)
-
Image Editing features (continued):
2. Edit in Preview mode. That is, when you enable the Preview mode in the Main Menu, when you take a picture - before it saved you will be presented with Preview of that picture which you can edit and then save or discard. This may be a useful feature when you need to take a picture fast and do not have time to set parameters and/or tools before taking the picture. You can then have time to change them in Preview mode. So first enable the mode in the Main Settings menu, if you want to use it:
(https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/?action=dlattach;attach=381936;image)
You can then change Tools, Palettes, view mode and measurement parameters and save the edited picture. The screenshot series below shows some of the editing features available in Preview mode. My video capture tool did not display the object picture when editing, just the tools. Hence the blank background. When you will be using Preview editing, you will be seeing the object picture as the background.
(https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/?action=dlattach;attach=381938;image)
-
Image Editing features (continued):
All these editing bits are saved as a separate overlay with the image. That is, you can always go back to the Archive and edit them again or remove them altogether.
So as you can see, the Liberated E4 Advanced features can get very overwhelming fast. Simply too many of them. Good or not - you decide for yourself. My task was to make it available.
I will probably stop at this point and let you guys digest what may have been the greatest liberation of E4 since sliced bread. It is not known if the manufacturer will bump up the protection in the next or following FW release for E4, so this may be your last chance to get one. Have fun ;)
-
Thanks Bud! It was a great work! :)
-
Great work!! Thanks a lot!! :-+
-
Bud, your work on this hack amazing..
Best Christmas present yet! :-+
-
Thanks again Bud, did test the E4++ little more and i love it :-+
Did check Backupfiles and the medical.pal is there from begining on no-wifi hw2.0 fw3.9.0.
Did read that its need sport mode to get medical pal, and the lines are in tool-conf.xml.
Woud like to ask squawk or any non-wifi owner if they also missing:
Sport mode
Medical palette
Screening mode
Window compensation
Sketch mode
-
Bud, just wanted to let you know it works like a charm! :D
One thing that got me curious though.. on one of your screenshots of "Image Mode", you have a "video" symbol.
Also, in the settings, it asks how you want video compression (mpeg or radiometric).
Did you manage to get video working?
And if so, will you release it? 8)
@ MRubert: yes, I did get everything to work, but I did have to turn "Screening Mode" to ON in the settings menu.
After that, also Sport mode was visible. Not sure what the relation is, but one seemed to facilitate the other.
Just to be sure, Sketch mode only works when viewing back photo's and selecting to edit them. I do have it there.
-
Without going back an reading 17 pages (I went back a few pages) can I go out and buy one off the shelf (amazon etc) and unlock it? I was aware of the hackability and then difficulty with non-wifi versions but I couldn't afford even the base camera then. Have hacks been released for all firmware versions of the E4 and E4 wifi to date? Thanks in advance!
-
There are some bugs in toolbar-config.xml.
There is no way to mix these entries:
<ToolBar name="imageMode_.....
<ToolBar name="measure_global_....
Try on image edit mode. Navigate in menu and the device will be freeze.
-
Glad to se that its working. :)
Did read Buds post #392 how to enable screening in menu, but screening is not in the menu at all.
Now i know its rollbacktime.
Is the wifi icon in the picture a hint ?
-
It do freeze for me to in that mode, i assume its no problem to delete it.
-
Looks like my router should be OK since Bud's has a similar signature! :-+
Thanks again Bud for all your help!
-
Bud, just wanted to let you know it works like a charm! :D
Thanks for the feedback ! :)
One thing that got me curious though.. on one of your screenshots of "Image Mode", you have a "video" symbol.
Also, in the settings, it asks how you want video compression (mpeg or radiometric).
Did you manage to get video working?
Sadly no, I could not get it working and the screenshot was from the time I was playing with it.
As to the setting in the Main Settings menu, I left it because was not sure if that may affect the way video may be transferred via USB or RTP, though at this time I could not get RTP (real time video over TCP) working. Also, I had some ideas for taking short video clips from the menu for Super Resolution processing purpose. But I have not gotten there yet.
...I did have to turn "Screening Mode" to ON in the settings menu.
After that, also Sport mode was visible. Not sure what the relation is, but one seemed to facilitate the other.
Hmm, this is interesting, never seen or noticed that. Not sure what to say.
-
It do freeze for me to in that mode, i assume its no problem to delete it.
Welcome to the wonderful world of tinkering with the liberated E4 :-+ Feel free to spend all of your free time playing with toolbar-config and design_ui.xml for the next week or two ;)
-
Without going back an reading 17 pages (I went back a few pages) can I go out and buy one off the shelf (amazon etc) and unlock it? I was aware of the hackability and then difficulty with non-wifi versions but I couldn't afford even the base camera then. Have hacks been released for all firmware versions of the E4 and E4 wifi to date? Thanks in advance!
Seems you have not read any of the posted pages, otherwise you would see this:
Advanced update package for E4 2.0L WiFi fw v3.9.0
This thread only has update for the above combination, but it's been reported that also works for 2.0L non-WiFi model
-
Looks like my router should be OK since Bud's has a similar signature! :-+
Thanks again Bud for all your help!
LOL.. ;D
I see you're using the "three-point" preset I adjusted. :)
I've been fiddling around with this preset to see if I could make it show the delta T value between the max and min measurements.
But I have not succeeded.. The only thing I managed to get is the delta T between the spot and max temp.
So, question to the smarter brains in this forum:
Maybe somebody knows how to get the delta T between minimum and maximum measured temperatures to show below, just like "preset_deltaSpot.rsc" and the "preset_deltaTemp.rsc" does?
-
Sadly no, I could not get it working and the screenshot was from the time I was playing with it.
As to the setting in the Main Settings menu, I left it because was not sure if that may affect the way video may be transferred via USB or RTP, though at this time I could not get RTP (real time video over TCP) working. Also, I had some ideas for taking short video clips from the menu for Super Resolution processing purpose. But I have not gotten there yet.
Ah, so that's why the icon was there.. ;)
It would be an overly awesome feature to have, but maybe the model (despite your kick-@ss skill in hacking) would be hardware limited in this case..
I figure video mode would require the necessary processing power for it to work.
-
Just a heads up, perhaps coincidence or FLIR Is monitoring this page but the wifi version is on a national backorder until the 16th of January
-
FLIR do monitor this forum and the upgrade related threads ;)
Whether they would resort to ceasing supply of the E4 is another matter. I very much doubt they would take such action as they have not done so previously. The hacking of the camera is not popular with FLIR, but I understand they are not losing any sleep over it ;D
E4 sales since the cameras release have been AMAZING !
Fraser
-
To be honest, I think the release of this 'hack' may even boost E4 (WiFi) sales more, for a people who otherwise may not buy it..
And FLIR can look the other way and gladly accept this boost..
win-win, right? :D
-
To be honest, I think the release of this 'hack' may even boost E4 (WiFi) sales more, for a people who otherwise may not buy it..
And FLIR can look the other way and gladly accept this boost..
win-win, right? :D
Well.. If it costs them the same to manufacture the E4 as it would the E8, and not having to support/honor the voided warranty on the liberated E4, they would be very smart to sit back and collect the profit.
Actually, what they really should do is send a bonus check to Bud for the boost in WiFi E4 sales! :-+ :-+ :-+
-
I personally do not think this caused any material change to the manufacturer. Since publising the Basic package it was downloaded only 250 times by now. Some people probably did it out of curiosity, so i think it may have been less than 200 units updated, which is nothing on the big scale of things.
-
Just a heads up, perhaps coincidence or FLIR Is monitoring this page but the wifi version is on a national backorder until the 16th of January
I am pretty sure it is going to be a new firmware version.
-
Well.. If it costs them the same to manufacture the E4 as it would the E8, and not having to support/honor the voided warranty on the liberated E4, they would be very smart to sit back and collect the profit.
Actually, what they really should do is send a bonus check to Bud for the boost in WiFi E4 sales! :-+ :-+ :-+
LOL.. I'm sure that if they're watching and reading that message, they'll be rofl.. ;D
-
Yeah, I tried to get one and am holding my breath I won't get like a 4.0 firmware.
It's true though, if not for the availability of the hack, I'd probably get the thermapp or thermal experts
-
Oh-oh, unexpectedly the thread has caused some damage to them with your decision :D
-
I can confirm BUD method is working on Flir E4 HW2.0 SW 3.9.0 WIFI and non WIFI.
Thanks Bud, for this hard work!
You are doing us all a very big favour...
-
Just saying that dont take my mistake seriusly, i was enjoying a bottle of "captain morgan" in the liberation time and i am noob in computer compare to Bud.
Next year i will spend some more time on it. :)
Definitley recommend to use the QR code or adress for support.
-
Fantastic new year !
If anyone gets semi advance uppdate with this symtoms on Reply #406,
The FTP was lying " files are copy with succes "
Basic conf.cfc was still there.
All is good now ^-^
-
If anyone is looking for a soft case for the Ex series, this is the cheapest I've found it.
Lowes item #701076 https://www.lowes.com/pd/FLIR-Digital-Test-Set-Meter/999986806 (https://www.lowes.com/pd/FLIR-Digital-Test-Set-Meter/999986806)
-
In US only delivery,, price, you save 8$ :palm:
Is it wrong to buy flir original accessory ? Definitley not.
We do have a very nice tool now, thanks to Bud.
-
In US only delivery,, price, you save 8$ :palm:
Is it wrong to buy flir original accessory ? Definitley not.
We do have a very nice tool now, thanks to Bud.
Sorry, I don't understand what you mean. As far as I know this IS Flir original accessory.
$8 and no shipping if picking up in store comes out to almost 25% savings.
Not my fault that you're not in US! 8)
-
Just like many other things, Lowes Canada does not carry it.
-
Just wanted to thank you for this mod.
Waiting for my E4 non-wifi model.
Thank you for your work
-
First off, thanks to Bud and all the folks that continue to keep this E4 camera an awesome deal for us newbies to IR scanning.
I recently purchased a lightly used E4 that was calibrated in Nov 2015 and it is 1.2L hardware and 2.8.0 firmware. Camera obviously has not been hacked.
I need to back up the camera before I do anything, of course.
I have seen a few successes with folks going from 2.8 to 2.11 and applying the 2.11 reshack and menu hacks.
I hooked up the camera to Flir Tools 6.4 (latest version as of Jan '18) and it says it can update the firmware in the camera to 3.12. Obviously don't want to do that right now - 3.12 is not yet hackable. Was not really sure the 1.2L hardware could accept the 3.x firmware but apparently they can if Flir Tools wants to upgrade my camera to it.
Was thinking of upgrading from 2.8 to 3.9 and using the reshack and menu hacks for 3.9. This would get the camera up to the most recent hackable firmware (which I would prefer).
Is this the way to go or should I just upgrade from 2.8 to 2.11 and call it a day? Or perhaps even go from 2.8 to 2.3 (would rather not "downgrade" the firmware as there is some more risk there)?
I have done quite a bunch or reading in both this and the teardown thread but questions like these are not easy to find the answer for. Especially for 2.8 (although it seems the prevailing opinion is to downgrade to 2.3 and hack). Would be nice to have a chart (wishful thinking) with the camera's original firmware and the best hackable solution listed.
Thanks in advance for any guidance/suggestions on my question.
Xenawise
-
First off, thanks to Bud and all the folks that continue to keep this E4 camera an awesome deal for us newbies to IR scanning.
I recently purchased a lightly used E4 that was calibrated in Nov 2015 and it is 1.2L hardware and 2.8.0 firmware. Camera obviously has not been hacked.
I need to back up the camera before I do anything, of course.
I have seen a few successes with folks going from 2.8 to 2.11 and applying the 2.11 reshack and menu hacks.
I hooked up the camera to Flir Tools 6.4 (latest version as of Jan '18) and it says it can update the firmware in the camera to 3.12. Obviously don't want to do that right now - 3.12 is not yet hackable. Was not really sure the 1.2L hardware could accept the 3.x firmware but apparently they can if Flir Tools wants to upgrade my camera to it.
Was thinking of upgrading from 2.8 to 3.9 and using the reshack and menu hacks for 3.9. This would get the camera up to the most recent hackable firmware (which I would prefer).
Is this the way to go or should I just upgrade from 2.8 to 2.11 and call it a day? Or perhaps even go from 2.8 to 2.3 (would rather not "downgrade" the firmware as there is some more risk there)?
I have done quite a bunch or reading in both this and the teardown thread but questions like these are not easy to find the answer for. Especially for 2.8 (although it seems the prevailing opinion is to downgrade to 2.3 and hack). Would be nice to have a chart (wishful thinking) with the camera's original firmware and the best hackable solution listed.
Thanks in advance for any guidance/suggestions on my question.
Xenawise
Go to 2.11 or 2.3, both should work just fine. I wouldn't mess with 3.9 as you're entering uncharted territory(old hardware vs Bud's hack being done on the new hardware) with no real incentive as the other firmware will get you the same exact thing.
-
I agree. Avoid going to 3.9 as Bud crafted his upgrade for a very specific firmware and hardware build. Updating firmware on older versions of the camera does install the firmware but not always in a way that mirrors the later models. There are recorded cases of FLIR upgrading forum members firmware after a repair and the camera firmware configuration being different to that of a camera that left the factory with the same firmware. Any differences could impact upon whether Bud's upgrade works or your camera crashes.
Fraser
-
I agree. Avoid going to 3.9 as Bud crafted his upgrade for a very specific firmware and hardware build. Updating firmware on older versions of the camera does install the firmware but not always in a way that mirrors the later models. There are recorded cases of FLIR upgrading forum members firmware after a repair and the camera firmware configuration being different to that of a camera that left the factory with the same firmware. Any differences could impact upon whether Bud's upgrade works of your camera crashes.
Yes, upgrading from 2.x to 3.9 and then applying the patches might bring you some trouble. I have a non-Wifi E4 that had FW 2.3 installed but new HW - apparently someone tried to downgrade the unit for whatever reason. Buds patches worked after applying the 3.9 FW, but I had to find and remove a redundant file to make the basic liberated menus work. Doing so requires some experience with FTP, file systems, comparison tools, fighting Windows nasty RNDIS ... it's not a newbies job.
If you're willing to get into some trouble, one may try Bud's patches on an old HW model updated to 3.9, but clearly not recommended.
Didn't try out the advanced liberation package yet, but many thanks to Bud for his great work.
BTW: Thanks to Fraser also, for pointing me into the E4 direction in some other thread ...
-
The FLIR E4 remains arguably the best value for money complete thermal camera solution ever produced...... thanks to the upgrade ;) To purchase a new 320 x 240 pixel complete thermal camera that performs very well is still not possible below $1000. The E4 upgrade can change that if owners are willing to effectively 'hack' their camera. An amazing 'payoff' results from the effort needed to do such.
As we all know, the upgrade is only possible due to the efforts of some very clever individuals on this forum. It goes all the way back to the start of this journey when Mike and others discovered that the E4 was likely the same as An E8, with just some configuration difference. I salute all who have made the upgrade of the E4 possible. They have done all E4 owners a great service. :-+
Fraser
-
Just a heads up, perhaps coincidence or FLIR Is monitoring this page but the wifi version is on a national backorder until the 16th of January
Looks like same for UK just rang a couple of suppliers no stock until late Jan early Feb...
-
non wifi E4 is in stock at messgeräte chemnitz - shipping to UK 15€
BR a.
-
Radio Spares UK have 112 in stock at £597+vat.
https://uk.rs-online.com/web/p/thermal-imaging-cameras/8481365/ (https://uk.rs-online.com/web/p/thermal-imaging-cameras/8481365/)
They also have 197 of the E5 for a higher, but not silly price of 797+vat.
https://uk.rs-online.com/web/p/thermal-imaging-cameras/8481369/?origin=PSF_437245%7Calt (https://uk.rs-online.com/web/p/thermal-imaging-cameras/8481369/?origin=PSF_437245%7Calt)
You do not need a trade account to buy from RS.
Farnell UK have just one E4 available from their Liege warehouse at £634+vat
http://uk.farnell.com/flir/flir-e4/thermal-imager-80-x-60-9hz-msx/dp/2401506 (http://uk.farnell.com/flir/flir-e4/thermal-imager-80-x-60-9hz-msx/dp/2401506)
Fraser
-
I have dealt with PASS when buying an E4 way back in 2013. They were a very good supplier.
Their site allowed me to add an E4 to my shopping basket so they may have E4 stock at £634+vat
https://www.tester.co.uk/flir-e4-thermal-imaging-camera (https://www.tester.co.uk/flir-e4-thermal-imaging-camera)
Fraser
-
The FLIR UK web shop also showed the E4 models to be in stock and available to buy. No sign of the model being 'on hold' so panic not ;D
http://www.flir.co.uk/instruments/ex-series/ (http://www.flir.co.uk/instruments/ex-series/)
Fraser
-
The FLIR UK web shop also showed the E4 models to be in stock and available to buy. No sign of the model being 'on hold' so panic not ;D
http://www.flir.co.uk/instruments/ex-series/ (http://www.flir.co.uk/instruments/ex-series/)
Fraser
haha thanks a lot Fraser - although I was referring to E4 w/ wifi model... Thought I'd get a wifi model to play with but no stock. Farnell said oh about 4 weeks earlier today. Some other supplier basically told me the lowest model now is E5 w/ wifi... :-//
Edit: Flir UK does seem to have E4 wifi in stock (almost more expensive than others) so no national shortage! ;D
-
Got myself 3D printed at a local shop a 2-part lens holder for close-up PCB work, and a ZnSe 20mm lens. Love the holder design, very easy to install the lens and put the holder on and take it off the camera. The 3D file was downloaded from Thingiverse (https://www.thingiverse.com/thing:2108075)
-
Got myself 3D printed at a local shop a 2-part lens holder for close-up PCB work, and a ZnSe 20mm lens. Love the holder design, very easy to install the lens and put the holder on and take it off the camera. The 3D file was downloaded from Thingiverse (https://www.thingiverse.com/thing:2108075)
That looks pretty good! What's the diameter of the lens? Is 20mm optimal for 6" away from PCB?
I printed the lens adjustment tool ( https://www.thingiverse.com/thing:197580 (https://www.thingiverse.com/thing:197580) ) which works pretty well, 1/3 turn counter-clock wise brought the PCB in pretty sharp at 6".
I'm curious if the additional lens would provide a sharper picture than adjusting the existing lens. Would you be able to post a pic of a PCB? I'll do the same once I get to the shop.
-
Manual adjustment of the E4 lens provides a better image than the use of the ZnSe close-up lens. Not everyone wants to mess around with their cameras focus however. I have used ZnSe close-up lenses for many years, long before the FLIR E4 came on the scene. It is a compromise solution that works 'well enough' but it does have its limitations.
1. The cheap Chinese ZnSe lenses on eBay are intended for less demanding CO2 laser cutter use. They are not exactly very high optical quality. HQ versions are also available but cost a little more. The relatively low resolution of a thermal camera allows us to 'get away' with such a lens.
2. The ZnSe close-up lens focal length needs to be chosen to match the needs of the user. I personally use the 100mm FL the most, but other users prefer the 50mm FL. 100mm FL is the greatest distance offered in the cheap lenses due to their intended purpose in laser cutters. Greater focal distance lens are available, but expect to pay significantly more for them (~£80)
3. When using a close-up lens, good focus becomes challenging when hand holding the camera. The reason is the severely reduced depth of field that results from the use of the lens. Tripod mounting the camera using one of the available 3d printable tripod adapters for the E4 will make life easier when observing PCB's.
4. The ZnSe close-up lens solution that many of us own is cheap and effective. The image quality is not as good as that provided by my FLIR and Inframetrics professional close-up lenses, but then those are relatively large lumps of precision Germanium optics and they cost several thousand Dollars each when new !
Hope this helps
Fraser
-
With regard to the focus tool design. I own all available versions and personally like the design and fit of this tool:
https://www.thingiverse.com/thing:188896 (https://www.thingiverse.com/thing:188896)
It fits my cameras focus ring indents perfectly.
Fraser
-
Thanks Fraser for the detailed explanation. :-+
-
Hey there Bud,
Thanks for all the hard work. I applied the basic and advanced packages. I may be doing something incorrectly (just got my first FLIR), but I believe I found a bug.
With the advanced package installed, if I select Object Distance from Image mode, whatever value I select seems to be multiplied by 3.33. If I select 0 ft, it is 0 ft, 1 ft = 3 ft, 10 ft = 33 ft, 2000 ft = 6562 ft.
Thank you others for the discussion on lens for PCB work, we hope to use one of these in a grad research lab.
-
Ryanbahr,
You might like to read through the FLIR E4 Useful Information thread that I started some time ago.
https://www.eevblog.com/forum/thermal-imaging/flir-e4-the-useful-information-thread/ (https://www.eevblog.com/forum/thermal-imaging/flir-e4-the-useful-information-thread/)
Best Wishes
Fraser
-
With regard to the focus tool design. I own all available versions and personally like the design and fit of this tool:
https://www.thingiverse.com/thing:188896 (https://www.thingiverse.com/thing:188896)
It fits my cameras focus ring indents perfectly.
Fraser
Is the sizing of this thing in mm or inches?
I don't have a 3D printer and when I send it to Shapeways, it asks if it's in mm, cm or inches.
When I choose inches, it resizes to something that now becomes: X:3.296, Y: 3.158, Z: 3 cm.
Not sure if that is the right size..
-
With the advanced package installed, if I select Object Distance from Image mode, whatever value I select seems to be multiplied by 3.33. If I select 0 ft, it is 0 ft, 1 ft = 3 ft, 10 ft = 33 ft, 2000 ft = 6562 ft.
The distance seems to be in meters, i am a metric guy and my camera was set up for meters. Not sure what can be done to have automatic units conversion...
-
Hello, i just upgraded my new E4 non wifi camera (2.0L, 3.9.0)
Amazing change!!
Thank you for your great work, Bud :clap:
I dont understand to bitcoins, its possible some paypal donation?
-
Hello everyone, new member here.
I'm curious if anyone has had any luck or knows if a FLIR E4 Wifi - 2.0L HW (3.12.0 FW) can be upgraded. In going through the forum it looks like it may be possible to load the 3.9.0 FW Markofq posted. Then follow Bud's amazingly helpful instructions.
Would appreciate any insight.
-
Hi All! Bud - awesome job on this. It took a little work to figure out the RNDIS and get my FTP going on a Windows 10 machine, but following your steps saved me from paying someone else to do it... and gave me a lot of personal satisfaction!
Thanks for your hard work! I have the basic install all set up on my E4 2.0L v3.9.0 - and confirmed all is working.
I had a question for the mobile app (FLIR Tools) for the iPad - I now have the ability to try to open up the camera live as a remote viewer, but when I do that, it gives me the message that “video format not supported”.
I am connecting via the share option on the camera directly to the iPad. The other features (capture) work. Any ideas? Or is it something that is opened up in the advanced tools? Thanks everyone!
-
Hey bud,
Thanks for the meters suggestion. I personally don't mind either unit. I think its a firmware issue, I don't think it is intentional.
What happens is that if I set the object distance, it looks like the firmware internally converts it to meters. The next time you check the value, it seems to be the converted value.
It's hard to explain. I uploaded a video to show you how it acts. Setting the units to meters fixes everything though.
https://streamable.com/l7vuq
-
With regard to the focus tool design. I own all available versions and personally like the design and fit of this tool:
https://www.thingiverse.com/thing:188896 (https://www.thingiverse.com/thing:188896)
It fits my cameras focus ring indents perfectly.
Fraser
Is the sizing of this thing in mm or inches?
I don't have a 3D printer and when I send it to Shapeways, it asks if it's in mm, cm or inches.
When I choose inches, it resizes to something that now becomes: X:3.296, Y: 3.158, Z: 3 cm.
Not sure if that is the right size..
By default, stl files should be mm units from my experience.
-
I am connecting via the share option on the camera directly to the iPad. The other features (capture) work. Any ideas? Or is it something that is opened up in the advanced tools?
I do not have an iPAD but in general IP streaming via RTP protocol does not seem to work with E4. Video capture (non radiometric) through USB works (I used VirtualDub software on a Windows machine). There is no difference basic vs advanced in this regard.
-
What's the diameter of the lens? Is 20mm optimal for 6" away from PCB?
...
I'm curious if the additional lens would provide a sharper picture than adjusting the existing lens. Would you be able to post a pic of a PCB? I'll do the same once I get to the shop.
Yes I used a 20mm lens with 3'' (76mm) focal length. Have not fired a board yet to test what image it will produce.
-
Hello, i just upgraded my new E4 non wifi camera (2.0L, 3.9.0)
Amazing change!!
Thank you for your great work, Bud :clap:
I dont understand to bitcoins, its possible some paypal donation?
Sadly it is only bitcoin option at this time but thanks anyway for your generosity!
-
With regard to the focus tool design. I own all available versions and personally like the design and fit of this tool:
https://www.thingiverse.com/thing:188896 (https://www.thingiverse.com/thing:188896)
This tool is on my next 3D job order list :-+
-
It works for me, windows 10, flir e4 2.0 non wifi with 3.9.
Looking after these focus tool!
-
This pic of a computer motherbard was taken from 10” away after turning th E4 lens 1/4 turn counter-clockwise. I believe i could have gotten better focus if I moved the camera slightly closer or farther away.
-
Cabny,
For info, you can focus the Ex series camera lens much closer than 10". The FLIR ETS320 dedicated PCB inspection camera uses the standard Ex series chassis and lens. It is factory set to focus at 70mm +-10mm. The lens appears to be approximately 2mm further out than when the camera is set for infinity focus. FLIR inserted two thin 'O' rings around the lens thread as spacers to hold the focus at the set position. See my ETS320 thread for more detail......
https://www.eevblog.com/forum/thermal-imaging/flir-ets320-design-comment-and-improvements-by-fraser/msg1348459/#msg1348459 (https://www.eevblog.com/forum/thermal-imaging/flir-ets320-design-comment-and-improvements-by-fraser/msg1348459/#msg1348459)
Adjustment of the lens enables imaging MUCH closer than 70mm. The downside is access. The head of the camera is relatively bulky so a PCB within an equipment can be a challenge for very close imaging. On the bench imaging is far simpler though.
The upgraded 320 x 240 pixel E4 makes a very capable PCB thermal profile imager but a tripod and tripod adapter do help to obtain stable images with excellent focus. The tripod adapters are available on Thingiverse for 3D printing. The advanced menu package that Bud has released also enhances the cameras usefulness for PCB inspection work.
Fraser
-
Hey Bud,
Question: is there a way to just increase the resolution but leave everything else the same? I am more looking for the resolution than anything else.
When I got to step 12 and powered on the cam after the common_dll.dll insertion, resolution was upgraded, but it didn’t recognize the memory card until I finished steps 14-17. Is there a way to stop there? I’m taking an ITC course shortly and am not sure what they will think of my modded camera... (should I take it back to stock for the course?)
Thanks again!
-
mrh,
Upgrading your camera is not illegal and ITC are well aware of this upgrade ;D They will have seem many upgraded cameras. Just do not expect them to endorse the upgrade ;) The upgrade does not impact upon the cameras calibration either.
Regarding the upgrade of the resolution only, that is your decision but be aware that the upgrade also switches off the dastardly false noise generator and so lowers the NETD of the camera to better than the E8 ! The upgrade also provides the addition of Zoom levels and thus can be useful 'in the field'.
Fraser
-
Question: is there a way to just increase the resolution but leave everything else the same? I am more looking for the resolution than anything else.
You first need to install the DLL, then decrypt your config and change the resolution related lines, set Noise to zero, then re-encrypt the config, upload and cold reboot (with battery removal)
-
First picture with factory set focus but from 12cm away (Otherwise you won't be able to see anything at all if any closer)
Second picture from 5cm away and focus turned (using the 3d-printed focus tool) one full turn counter-clockwise.
The large square chip in the middle is only 9mm wide!
This is truly amazing! :-+
-
Cabny,
Good isn't it ;D
If you look at the back of your hand with very close focus you will likely see pours of you skin in contrast to the skin around them :)
Fraser
-
Cabny,
Good isn't it ;D
If you look at the back of your hand with very close focus you will likely see pours of you skin in contrast to the skin around them :)
Fraser
Yes I did notice that! and hair too! ;D
-
With regard to the focus tool design. I own all available versions and personally like the design and fit of this tool:
https://www.thingiverse.com/thing:188896 (https://www.thingiverse.com/thing:188896)
It fits my cameras focus ring indents perfectly.
Fraser
Is the sizing of this thing in mm or inches?
I don't have a 3D printer and when I send it to Shapeways, it asks if it's in mm, cm or inches.
When I choose inches, it resizes to something that now becomes: X:3.296, Y: 3.158, Z: 3 cm.
Not sure if that is the right size..
By default, stl files should be mm units from my experience.
Thanks!
I'll let you know if you were right.. ;)
-
Just got my Flir E4 Wifi in with 3.12 factory firmware installed, looking around for Flir 3.9 firmware, it's been taken down on the website and the links don't work from someone's upload
-
Hello theBigK
Here is the file I downloaded from Markofq's link. https://ufile.io/vil2l (https://ufile.io/vil2l)
I haven't tried it myself yet. Best of luck. Let us know how it goes.
-
Thanks so much!! I will attempt the basic upgrade tomorrow, wanted to jump into the advanced but figured I'd wait until I learn all the current menus
-
Hello everyone, new member here.
I'm curious if anyone has had any luck or knows if a FLIR E4 Wifi - 2.0L HW (3.12.0 FW) can be upgraded. In going through the forum it looks like it may be possible to load the 3.9.0 FW Markofq posted. Then follow Bud's amazingly helpful instructions.
Would appreciate any insight.
I am too wondering if it's possible to downgrade? I still have a return policy on this one, so not afraid to try to do it just wanted to know how to go about it or just return it and try to find one with lower firmware.
I incorrectly read firmware numbers, I thought mine was 3.9.0 while 3.1.2 was the older one, obviously got that backwards.
-
Here is a version of the Basic Package for E4 WiFi 2.0L, fw v3.12.0
I do not have a 3.12.0 device, so this version has not been tested.
YOU TRY AT YOUR OWN RISK.
=============
Update: Basic Package v3.12.0 is confirmed working.
Update: Advanced Package v3.12.0 is confirmed working.
Update August 2018: New camera version v3.13.0 confirmed working with this v3.12.0 Basic Package. See post here:
https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1733972/#msg1733972 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1733972/#msg1733972)
-
Anyone have access to the 3.12.0 update pack (.fif)? Not sure where we get that from...
Nevermind, found it on their support site to download.
http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_ex_pn639_v3.12.0_update_pack.zip (http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_ex_pn639_v3.12.0_update_pack.zip)
-
Bud and several others, Thank you so much. :-+
I am not sure if everyone on here realizes this, but these procedures basically turn a Flir E4, $1000, into a E8, $3000....a pretty damn good return on some time and effort. This would not pe possible without all the hard work and time Bud put into this.
Thank you Bud and all others for helping people with this project!!!!!
-
I noticed that there are still old model and new model E4's still available on Amazon. Both are currently $949. Both the previous E4 1.2L and the current E4 2.0L (mine came with 3.12, but I easily downgraded it to 3.9 as required by the tested and approved method) models) are available.
A question for all of you very experienced users: For those who may be looking at buying one, are there any differences in the performance or specs of either one after it has been modified?
Thanks!!!
-
hi tbuck, can you help me out with downgrading my unit? Or at least point me to the info of where I could do it?
-
I just ordered a new E4 from Tequipment and its projected ship date is Feb 13th. Gonna try this in Feb looks like. |O
-
BigK,
There is a link to the upgrade/downgrade file in the post immediately following your request for it. The instructions are included in the zip file.
Please understand that people on here will be much more helpful if it looks like you have tried hard to find the answers before you ask on this board. This topic ONLY has 20 pages and if you look you will see that I never posted once until I had success, despite the fact the I DID have issues.
Also I knew what you meant when you asked for help on your downgrade, (because I had seen and read all of your posts) but for your own benefit, you need to be more specific, especially in a post asking for help. The words downgrade can be used to mean several very different things pertaining to this subject.
-
I didn't take a closer look at the 3.12 files but in my mind that was an unsafe option so I was asking on the procedure to downgrade firmware to 3.9, I could take it from there. I wasn't sure if your procedure was different than Bud's, sorry for not being specific. I was at work and I know many of us are on different time zones so wanted to post and gather all the data before I attempt to void my warranty :)
-
You follow the procedure for downgrading from 3.12 to 3.9 as shown with the 3.9 download. Then you follow Bud's procedure for the Basic and if you want the Advanced upgrades.
Also, please do the full backup before attempting the upgrades and also print out or save the recovery procedure. And don't expect to do this in a short period of time or with distractions...trust me it can be a little tricky.
Good Luck!! :-+
-
Here is another little enhancement which you can do by yourself:
Open the file design_ui.xml in a text editor
FlashBFS/system/ui.d/design_ui.xml
find the string
"toolbarSeparators" value="false"
change "false" to "true"
Reboot the camera.
The menu bar background changes from black to transparent as you use it to change settings/palettes, resembling a computer desktop with icons.
(https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/?action=dlattach;attach=386921;image)
You can leave it like that if you prefer it that way, or revert the change and reboot.
Have fun !
-
Hi everyone, this is my first post in this forum. Big thanks to Bud for sharing files for unlocking the camera. I have a question, after hacking the camera is not connected in the flir tools program. I have to manually download photos using filezilla and later add to filr tools, is it normal? Before the hack, the camera was connected in flir tools.
-
Have you returned the camera to its original USB port mode ?
In RNDIS you can use FileZilla etc but it no longer appears to a PC to be a Mass Storage Device.
You need to return the camera to UVC-MSD mode for normal daily use.
Fraser
-
Thanks so much for the tip. After all, it's that simple. Everything works.
Termo
-
hi guys, I am on step 9, and my PC crashed, I cannot get the camera to connect to my home wifi, nor share it's wifi. It was working earlier. I am asking on whether I should be looking at my network settings and trying different routers, or is it because I crashed while in telnet with using stopapp command?
-
I turned it off over night and it connected to WiFi, after trying to diagnose my connectivity issues for almost two hours. Sometimes take a break, shut things down, and try it again! I have liberated the 3.9 and downgraded the 3.12 thanks everyone for the help. It took a little longer than expected but well worth it, now to learn the new menu and how to use this properly in a PCB application as well as diesel and gas engine application
-
good to hear that! you did not 'have to' do it via WiFi, USB works a treat and in some cases is the only way when wireless connectivity is lost.
-
First of all a BIG thank you very MUCH for Bud
Read for hours and prepared myself well. Laptop with windows 7 32bit and all recomended software installed.
My E4 has hardware 2.0L and software version 3.12.0 and is without wifi.
Followed all the steps Bud described in his upgrade procedure "Liberating FLIR E4 WiFi ver 3.12.0"
Unfortunately I failed in liberating my E4
The line "python cfccfg_v2.py XXXXXXXXXXXXXXXX conf.cfg conf.cfc" gives me an eror: can't overwrite same file name.
So best to do I think is to restore backup and try again from 0.
Maybe someone knows what is wrong in that phyton line.
-
You perform this step outside of the camera, so not sure why you think you need to restore the backup, you have not changed anything on the camera yet.
make sure there is no other conf. cfc in the folder where you run the command, and that you enter filenames and extensions correctly.
-
I fidled around a lot and finaly got a conf.cfg file that I uploaded to the camera.
There is only one conf.cfg file in the folder, it's the conf.cfg file where I added the 9 diggit serial.
Than I start the phyton command and get above mentioned error.
So I clean up the mess I made and try again tomorrow, now I understand the workflow better and know how to start RNDIS
-
You may have erroneously typed the same file name extension twice, i.e.
python cfccfg_v2.py XXXXXXXXXXXXXXXX conf.cfg conf.cfg"
-
Hello. Today got second FLIR E4 2.0L Software 3.12.0. It is without wifi. Few years ago i hack E4 with 2.3 software. But now new version and need some help.
So resolution hack working good with 3.9 version? yes? Daes anybody can share link with downgrade files?
-
Hi Bud,
Yes you are right I used twice the file ending CFG instead of CFC and CFG.
So everything went right this time, every stepp worked without any problem.
Camera is working just as before, but unfortunately the resolution stays at 80x60.
But one question about the SUID string, should I use the "xxxxxxxxxx" or xxxxxxxxx way ?
I fired the python command without " " around the SUID
-
it should not have qoute characters around the suid value.
you need to login to the camera and double check if you have replaced the common dll and the config file and that they are in the right folders. Look at the file dates. Also decrypt your original config, strip the serial number and post the content of the config here for us to take a look.
-
Hello Bud,
Again I wish to thank you so much !
Problem found: I had to delete first the two existing conf.cfg and conf.cfc on the camera than transfer the freshly generated conf.cfc to the camera.
Also I had to downgrade from 3.12.0 to 3.9.0 and everything works like a charm, even the advanced pack from you.
Spend almost whole day behind my pc, have square eyes now, but learned realy much in such a short time from you !
-
So how dongrade 3.1.2 to 3.9.0? Please share good link with files.
-
From 3.1.2 to 3.9.0 it's a upgrade.
All the information needed is in this thread, I have not so great skills to explain exactly how.
But reading this thread and the big E4 thread in this same forum does the trick ! !
But basicaly the steps are:
- Install Flir device drivers.
- Download firmware you want. (link in this thread)
- Install flirtools.
- Find in instaled dir FLIRInstallNet.exe
- Install with flirinstallnet the downloaded xxx.fif file.
-
I dont understand. I buy refurbished devise from https://uk.rs-online.com ? Maybe somebody can explain?
I read forum, and wanted hack resolution, but if i good understand by pictures properties my flir olready have 320 resolution? I make photo. Flir looks like new, photo counter are from first photo. On calibration certificate write model 63901, but on flir stiker write 63900. It is good? My flir have 3.12.0 firmware.
-
Looks 80x60 to me.
-
But why prperties write 320x240?
-
63901xxxx is the serial number, not the model number. All the units start with 639 however now that the serial numbers have reached over 99999 they added a 0 in front starting off at 639000001 (I might have an extra 0 or 1 in there, but you get the point)...
Looks 80x60 to me as well, noise definitely isn't removed so I'd try again.
Is it saying 320x240 for the digital resolution or the thermal resolution?
-
But why prperties write 320x240?
You should press the Archive button on the camera, select the image and view its properties. You do not check thermal image properties from the computer using File Explorer, it won't tell you unless you use specialized software.
-
Yes, I am stupid :) Now checked with flir and show 80x60. Last time i do it two years ago. Lets try hack now :)
-
Hack working good with downgrade to 3.9.0 version. Only 3 spot mode not working. Must show hot, cold and center, now all show same temperature.
-
you can copy the other 3 points preset from your 2.3.0 camera, it was just a different preset, do not confuse people saying "not working".
-
OK, after I liberated my E4 there are 2 minor points: battery icon is gone and msx-aligment on short distances is off.
Can I do here something ?
-
i recall battery icon appears when you invoke the toolbar (press Select button). you can see in the above screenshots there is no battery icon in normal view mode.
not sure what you mean by msx alligment being off. you set distance allignment in the Settings menu in Basic package and either in Settings or in the toolbar in Advanced one. The E4 does not perform automatic aligment.
-
I tought battery icon is always vissible, no problem, this way is just better.
I played a bit with distance settings now and that did the trick.
My problem was that the MSX overlay was not exactly over the heat image, this was good vissible with small objects.
-
I had some issues with connecting through ftp in RNDIS mode with windows 10 x64 so I thought I'd share what I did. I downgraded from 3.12.0 to 3.9.0 so far, and already can connect through ftp on wifi with the original flir/3vlig login.
I put it into RNDIS mode. Then using ipconfig, it showed something like INFRARED as the DNS suffix and had 192.168.1.1 as IPv4 address and Default Gateway as 192.168.1.2. It wouldn't connect, so I cycled power on my computer and camera. When reconnecting, the suffix is now blank, so is the ip address and gateway. So I read to set static IP as 192.168.250.1 then connect with 192.168.250.2. Using other IP addresses will not work. So after figuring that out, it turns out Anonymous login works while the original user/pass of flir/3vlig does not work.
EDIT: Problem though, FLIRvers.rsc does not pop up. I was able to copy the file using Wifi but not RNDIS.
also, I found in the log for flir as username. "331 User name okay, need password."(< it'll say the same for whatever I type) So, is there a different password for RNDIS? I also made sure that FLIRInstallNet shows "Ethernet 2 - 192.168.1.2" in case I had to use it.
-
Try connecting using the metod described in Recovery Procedure on page 8.
-
Still no FLIRvers.rsc. Only in Wifi does it work.
-
That file is only needed to get your SUID. It is not needed for liberation. You also can read your SUID using the second method, it is all in the readme file in the package.
-
Ah, ok. I'll proceed onto the liberation. Thankyou!
-
Well, it's done. I had to do it twice because either using Powershell instead of command prompt, or two cfc files in the folder caused issues. It almost looked worse than 80x60 at that time. It's amazing afterwords. Thankyou again!
-
is E5 3.9.0 liberating in the same way? did somebody try?
-
Hello Bud, I finally had a chance to run through the process. Works a treat. The difference is incredible. Thank you for all your hard work and patience with all the questions we mere mortals come up with. -HH
-
Hello everyone,
Does anyone have a version of Flirtools that allows for downgrading a E4 2.0 w/wifi running 3.12 back to 3.9. I have used the following Firtools versions with no success. I see my unit in the update section, press CTRL+Shift+Alt, I see the area around the E4 highlighted, I click it and nothing opens ( i assume a file manager dialog opens). If i press enter while this section is highlighted, Flirtools closes.
5.13.17214.2001
6.4.17317.1002
I also used an older 4.xx version but that could not find my E4.
On a side note, has anyone been able to try out the 3.12 hack that Bud posted a few days back? Did it work for anyone?
Preemptive thanks to everyone.
-
3.12 hack works just fine, no need to downgrade to 3.9
-
Thanks Dave. Yes I can confirm the 3.12 update worked perfectly. Super interested in the advanced features for 3.12. Looking forward to Bud's future releases. Thank you Bud and everyone who contributed.
-
Thanks DaveWB and blaqdragun. You can go back to page 20 and download the Advanced pack for 3.12.0.
-
Darn. I sincerely apologize. I ran this hack and commented without completely inspecting my unit.
I believe I spoke too soon regarding the basic at least for my install...I assume the shooting menu should include more than the following:
Recording Mode: Only has Single Shot
Thermal Menu (2 Stacked Windows Icon): Is disabled
Measurement: Only has No Measurements and Center Spot
Color Menu: Seems to only have 1 row of the basic palettes namely: Iron, Rainbow, Rainbow High Contrast, White Hot, Black Hot, Arctic, and Lava
Temperature Scale: Only has Auto.
I confirmed the resolution hack using Exifdata.com
MakeFLIR Systems ABModelFLIR E4 WifiExposure Time1/40 (0.025 sec)Focal Length6.5 mmFile Size16 kBFile TypeJPEGMIME Typeimage/jpegImage Width320Image Height240Encoding ProcessBaseline DCT, Huffman codingBits Per Sample8Color Components3X Resolution72Y Resolution72Software3.12.0YCbCr Sub SamplingYCbCr4:2:0 (2 2)YCbCr PositioningCenteredDate and Time (Original)2018:01:26 09:57:39Color SpacesRGBDigital Zoom Ratio1CompressionJPEG (old-style)OrientationHorizontal (normal)
I retraced my steps, but still got the same results. Any ideas? I assume I should not move forward with the Advanced if the menu items for the basic are not appearing, correct?
Edit#1
DaveWB does your menu appear correctly?
Edit#2
Reverified the image resolution using http://exif.regex.info/exif.cgi. (http://exif.regex.info/exif.cgi.) The extracted image says 80x60. Rechecked my setup and I overlooked the fact that I am running a Win7 64bit laptop, not a 32bit one. :palm:
I assume this resolution failure is due to using the 64bit machine to run the python script, correct? Does anyone have information on running a VM for this liberation? Again I apologize for the misinformation.
-
Known rabbithole is that one of the old conf. or common is still there in camera.
One way is to delete first then copy if you are to lazy to use stopapp.
check file date to be shure copy is done in camera.
There is a good easy phython explanation in this thread with picture.
-
This is a very nice ad Bud: "toolbarSeparators" value="true"
Better overview. Thanks.
Can 2.0 owners dream about getting higher temerature messurement ?
-
Edit#2
Reverified the image resolution using http://exif.regex.info/exif.cgi. (http://exif.regex.info/exif.cgi.) The extracted image says 80x60. Rechecked my setup and I overlooked the fact that I am running a Win7 64bit laptop, not a 32bit one. :palm:
I assume this resolution failure is due to using the 64bit machine to run the python script, correct? Does anyone have information on running a VM for this liberation? Again I apologize for the misinformation.
using Python 32bit on 64bit Windows seems to have worked for me....
-
Known rabbithole is that one of the old conf. or common is still there in camera.
One way is to delete first then copy if you are to lazy to use stopapp.
check file date to be shure copy is done in camera.
There is a good easy phython explanation in this thread with picture.
yes make sure to delete the original dll and conf, then copy the new ones and double check the timedate stamp on them.
-
@blackdragun: you have classic symptoms of the config not loading. redo your dll and config as said above.
-
Can 2.0 owners dream about getting higher temerature messurement ?
not as i know of.
-
The Ex series do not contain the required additional pixel bias voltage tables or associated calibration files for the other temperature ranges.
The temperature imaging capabilities of the Ex series may be extended using various attenuators placed in front of the lens. A non multi coated UV (Haze) glass photographic filter enables imaging of a gas flame etc. Sadly calibration is not simple though. Other materials can act as attenuators as well. It is a case of experimenting. Try plastics first.
Fraser
-
Hi, new member here. First of, a huge thanks to Bud, Fraser, Mikes, and many others who greatly contributed to the pertaining TIC threads here and leading to the E4 "upgrade for personal learning" liberation, as well as deeper understanding of how TIC and thermography works trough experiments and vulgarisation of the matter.
Just like another member here, I wish I could donate to Bud, but unfortunately doesn't use Bitcoin or any block chain platform. I do have paypal and every other money wiring means tho, so I'll be happy to send some your way Bud if you ever provide another mean of gifting you.
I bought my E4 wifi 2L 3.9.0 in early december 2017, calibration card said sept. 27th 2017. Yesterday I got around to do the full upgrade with the basic and advanced packages as well as the preset_threeSpots mod from Squawk. Then I spent the next 24 hours discovering even more of what's around me, including some deceiving ghost hunting in a huge cemetery at midnight in -18° C (I guess ghosts don't come out when it's that cold ?) and go some gorgeous pictures of trees against the clear sky.
I've read most if not all of the related threads to the E4 on here in the last months and felt confident about the procedure. It did help that I'm computer inclined and know my way around, however I really had trouble like many others regarding the step about the Python command line. I think it would help to provide a bit more detailed insight on how to perform the step for those who aren't familiar with this. I'll explain how I made it work for be in my next post below.
Thanks again to everyone for your time and efforts, it was thrilling to first explore with the base E4, now it's truly amazing to witness the world with a higher resolution and more versatile palettes and measurements options.
Also worth pointing that you can record video and remote control the Flir camera using the free PC-based Flir IR Camera Player (http://www.flir.com/instruments/display/?id=50428 (http://www.flir.com/instruments/display/?id=50428)) from Flir, as I haven't seen any mention of this yet in the "can I record video" discussions here.
-
From Bud's Readme file in the 3.9.0 Basic Package :
...
4. Obtain cfccfg.zip archive:
https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg596959/#msg596959 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg596959/#msg596959)
and extract cfccfg_V2.py from it.
5. Install Python 2.7 . The script may not work with later Python versions.
6. Open the supplied conf.cfg , scroll down to the very bottom to the line that starts with "# ID " and replace the 9-digit number with your camera serial number.
Save the file.
7. Encrypt the updated conf.cfg from step 6 with your suid by running this command from command line on your PC with Python:
python cfccfg_v2.py XXXXXXXXXXXXXXXX conf.cfg conf.cfc
(where XXXXXXXXXXXXXXXX is the suid string from step 3)
This step will produce a new encrypted conf.cfc .Save it to your working folder for transferring to the camera.
...
So after you've copied-pasted the URL of step 4 in your web browser, you'll reach this post :
Just a small update on cfccfg.py for 2.3. It now drops the signature/tail from the .cfg file. You can also make changes to the .cfg in plain text before converting back to .cfc, the file tail is created with the proper file size info (the signature is set to all 0). Note that you need the "HIRES" patch first in order to skip the CRC/signature check for this to work.
I tested adding a few lines to the .cfg file (comments, putting back 80x60 resolution...), convert to .cfc and use that on camera. Seems to work fine.
original post:
https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg594600/#msg594600 (https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg594600/#msg594600)
The attached cfccfg_V2.zip file is the one you need. Download it and then unzip the folder. Inside the folder, you'll find a cfccfg_V2.py file and you'll have to move or copy it to the Python main folder that was created upon the installation of Python (on my computer the Python installer default path was directly to the main C: drive, but you can specify another path like the Program Files folder). I decided to keep things simple and have the Python folder directly on my C: drive.
After reading on this thread that people where having the same issues with syntax and line1, and Squawk saying something about the .cfg file path that had to be specified, I started trying combinations of everything with the PC command line, the command prompt, the Python command prompt, etc. So here's what to do :
I moved the conf.cfg file of step 6 to my C: drive, then ran the following line from the PC command line that's available in Start Menu/Run.
python cfccfg_V2.py XXXXXXXXXXXXXXXX C:/conf.cfg conf.cfc
I did replace the XXX with my SUID obviously.
Once you click "Ok", nothing seem to happen, but if you look into the Python main folder, you'll see that a new file (conf.cfc) was created ! Simply copy that file back to your working folder where you keep your other files to be transfered (I copied mine into the basic 3.9.0 folder where the conf.cfg file was taken from).
The best way to get it right is simply to copy-paste the command line of step 7 into a new text file along with your SUID and then replace the XXX with your SUID and add the proper path to the conf.cfg file (easiest way is move the .cfg file to your C: drive and add C:/ to the command line).
Hopefully that helps. I've posted screenshots below.
-
The Ex series do not contain the required additional pixel bias voltage tables or associated calibration files for the other temperature ranges.
The temperature imaging capabilities of the Ex series may be extended using various attenuators placed in front of the lens. A non multi coated UV (Haze) glass photographic filter enables imaging of a gas flame etc. Sadly calibration is not simple though. Other materials can act as attenuators as well. It is a case of experimenting. Try plastics first.
Fraser
That is great help,
i do not need any exact numbers on higher temperatures. Most offen the interesting is to see the difference.
Plastics i will try :)
I am still learning about this after 100 and 100 and 100... pages.....
Only in one building is so many variabels. One flore heating was crystal clear, other was smear out in cement ofcource and so on. ( lettit cold down and fire up the heating is one way ).
High heat i was thinking about is automotive catalytic converters. Maybe not that importent, can still messure the o2 values and the backpressure that tells the condition anyway or better way.
I like this tool :-+
-
You may pull something together using a attenuator filter as Fraser suggested, and using the External Window Compensation feature in the Advanced pack. That would be interesting to see if with that combination higher temperature can be measured with acceptable accuracy.
-
I think it would help to provide a bit more detailed insight on how to perform the step for those who aren't familiar with this.
the easiest way is probably just put the cfg in the Python folder and run the command from there. This will eliminate the need to specify paths.
-
Also worth pointing that you can record video and remote control the Flir camera using the free PC-based Flir IR Camera Player (http://www.flir.com/instruments/display/?id=50428 (http://www.flir.com/instruments/display/?id=50428)) from Flir, as I haven't seen any mention of this yet in the "can I record video" discussions here.
For some reason that player never worked for me thru Ethernet. Also, as far as I remember it does not display radiometric video (i.e. with temperature measuring cursor so you can measure different parts of the image), it is just a color overlay. For true radiometric video streaming we made an effort here (https://www.eevblog.com/forum/thermal-imaging/flir-ex-realtime-raw-radiometric-data-streaming-via-uvc/msg749464/#msg749464) but it was a quite convoluted solution and only available on Linux.
-
I restarted from scratch and stopped at the dll step. Can someone please let me know if the attached image is the full 320x240?
-
No it is not
Just the DLL step alone does not enable resolution. You must do your config.
-
I am not sure the cfc file is created correctly. The attached file has lost the thermal resolution information and my shooting menu is crippled again.
I followed the steps correctly. Perhaps my SUID is wrong? In step 3 you ask to get the SUID by two different means. Why is that? We expect them to be the same right? I copied the SUID to the cfg file and encrypted it with the "python cfccfg_v2.py XXXXXXXXXXXXXXXX conf.cfg conf.cfc"
script.
I then delete the old cfc and upload my newly created one. I apologize if i am missing something obvious. |O
Edit#1 - I am running Python 2.7.14 (x86 version) on Win7 64bit.
-
Also worth pointing that you can record video and remote control the Flir camera using the free PC-based Flir IR Camera Player (http://www.flir.com/instruments/display/?id=50428 (http://www.flir.com/instruments/display/?id=50428)) from Flir, as I haven't seen any mention of this yet in the "can I record video" discussions here.
For some reason that player never worked for me thru Ethernet. Also, as far as I remember it does not display radiometric video (i.e. with temperature measuring cursor so you can measure different parts of the image), it is just a color overlay. For true radiometric video streaming we made an effort here (https://www.eevblog.com/forum/thermal-imaging/flir-ex-realtime-raw-radiometric-data-streaming-via-uvc/msg749464/#msg749464) but it was a quite convoluted solution and only available on Linux.
The IR Camera Player software allowed me to control the camera via USB and mirror the camera display to the computer as well as saving still images and recording videos. All adjustments and settings were done using the camera settings, except that you could use the keyboard instead of the camera buttons. That would allow for an easy remote control of the camera (let's say you're logging data from inside a car with the camera mounted outside of said car to avoid sticking your hand and head out of the car since the windshield or windows are blocking the view) and a cheap and easy way to make thermal recordings.
-
I followed the steps correctly. Perhaps my SUID is wrong? In step 3 you ask to get the SUID by two different means. Why is that? We expect them to be the same right? I copied the SUID to the cfg file and encrypted it with the "python cfccfg_v2.py XXXXXXXXXXXXXXXX conf.cfg conf.cfc"
script.
Does not seem you followed the steps correctly. You do not copy the SUID to the cfg file. You copy the camera serial number to the cfg file - please re-read the instructions. Do not confuse S/N with SUID, they are totally different.
Two different means to read SUID is just that - 2 different means. they give the same SUID.
-
Changing my username to moron at the time of this writing.
Of course, everything worked perfectly as soon as I actually followed the directions Bud meticulously assembled. (Reading is fundamental...) I am the proud new owner of a liberated E4 wifi!
I need to look into a way to compensate Bud for all the time spent on this project and with me personally. Thank you very much to you (Bud) and everyone who contributed to make this liberation a reality.
Ok no more wasting your time. Happy thermography-ing!
-
trying to realign MSX after liberation but can't seem to get the CRC32 computed... |O
I am using the script from here: https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/4375/?action=post;quote=406423;last_msg=1405463 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/4375/?action=post;quote=406423;last_msg=1405463)
and computed on the original calib.rsc (minus the last line) and got a different result vs the one in the last line. Anyone know if they are using a different algo now? seems unlikely but a bit stuck.... :palm:
-
What is wrong with adjusting MSX using the menu?
-
thanks Bud for replying; nothing wrong - I didn't know you could... |O
Just tried though: won't allow me to adjust left and right (or I am missing something else :()... I attach a misalignment example.
-
Horizontal misalignment may be a manufacturing defect. You can roll back the change and if it still there you better ask for a replacement camera or repair under warranty.
-
is it not just some calibration issue? I have recalculated all the C0 and C1s. Just can't compute the right CRC...
Yes it's still there after rolling back to the 80x60 darkness... :-//
-
I too experience horizontal misalignment, however it might be due to a hardware limitation, since the misalignment is very significant on a image with important focal subjects despite the MSX adjustment being set to >3m and misalignment happening from anywhere within 1m to +20m. It would be interesting to have a manual realignment of MSX on the horizontal plane too, as well as being able to specify the alignement distance in Flir Tools also.
-
hopefully not too limiting! I just got the CRC bits to work - rookie mistake on line break type - so will be checking if can get it to align a bit better by changing the C0 and C1s in the calib file...
-
I just went trough the procedure of horizontal MSX alignement, I did a rough calibration but I was more concerned about actually being able to tune the X offset rather than achieving perfect alignement right away.
I started by connecting my laptop to the E4 wifi broadcast and then using Putty to connect trough Telnet protocol (192.168.64.1, port 23).
To find out the current xpanVal of the camera, I entered rls .image.fusion.xpanVal
I was returned a value of 15, which I then changed to 10 by entering rset. image.fusion.xpanVal 10
The horizontal offset moved to the left, and was very close to perfect alignement. However the xpanVal gets reset when you take a picture or when the camera auto-calibrate, so it's kind of a pain to find the perfect value in a rush.
I then made a copy of my calib.rsc file from my backup folder and renamed it calib_old.rsc and edited the calib.rsc file to change the C1X value from 15.75798etc to 10. I deleted the last line of the file (# CRC32 2jvh2232etc) and saved the file. I installed 7-zip and with a right click on the recently changed calib.rsc file, choosing the CRC option from the window explorer menu, then CRC32 check and it gave me the new CRC32 for the file. Wrote the CRC down and then open the file and wrote it down at the end (# CRC32 etc). Saved the file and then connected to my E4 wifi again and using WINSPC FTP program, I connected to 192.168.64.1, username flir, password 3vlig trough FTP protocol. I went to the camera FlashFS/System/calib.rsc and made a new copy of it to my computer before replacing it with the new calib.rsc file. Then click disconnect, power down the camera, remove battery and power back up and voila.
-
This is what it looks like now with the realignment, before hand thermal blending always felt off and awkward, now it's close to perfect.
-
If there is some way I can send you ethereum for this let me know! I'm hugely grateful for the effort and risk you put forth Bud, you're the reason I just purchased an E4 WiFi today!
-
Trying to get the basic working on my 3.12.0 Flir E4 without wifi. With RNDIS I don't always get a decent ip con the camera. After the common.dll replacement and reset I don't get a ip anymore. (I used to get something like 169.254.18.75 on the camera and once 192.168.02)
Now the ethernet connection doesnt receive anything and the ip I get is 169.0.18.74 and the camera has nothing. (no gateway)
I tried both temp as perm RNDIS methods, at the moment the FLIRInstallNet can't even connect to the camera anymore. (Can't remove RNDIS permanent)
Anybody knows what is going on here? I already tried a hard-reset.
EDIT: reset of my pc helped, maybe I did not close the Telnet connection after doing the stopapp. Got full resolution now, thanks a lot for the effort put into this! :)
-
He takes bitcoin if you look a couple pages back ;)
-
Everything went fine with 3.12.0 FlirE4 no Wifi with Buds "basic package". Thanks a lot to all in the blog (Bud!!), very good work, excellent! :-+
Concerning the "advanced package" I noticed, that the file names of the original camera setup are different from that mentioned in Buds files (they have a "_z3" added at the end of the filename, look at the screenshot). I tried to rename and update, but that leads to "anonymus" FTP work... (no password needed at my camera model!).
Possibly I have a new software version unkown yet? :-// It was bought some weeks ago, file dates are 31.10.2017 at the mentioned files.
Update: Thank´s a lot, everything is working well with 3.12.0, advanced and basic mode. Only problem is the connection with Windows10 64bit. I switched to a laptop Windows7 64bit, problems are gone completely.
-
Do not touch the _z3 files, they have to be left there untouched for the camera to boot.
-
Modded common_dll file from 3.12 update package in case someone need it. (7Zip archive)
Sorry didn't see untill now that BUD already post it some time ago
LE: I have a C2 camera. How can I set below and above temps, I have no extra buttons on camera? Any chance to use the temp bar as a slider, because that box is very tiny?
-
Sorry this thread is for E4. Please open a separate thread for your C2 to avoid confusions.
-
Hey Bud, look what I found with Spirit right this moment. This is on my E4 wifi advanced package and spirit down arrow key press to open his custom menu. When I hit back to close his menu, I'm stuck with this screen and the down button nor any other button will dismiss it. Have to reboot the camera, since even after killing Spirit's exe process the down button would work on your popup.
Never seen it before either.
-
Sorry this thread is for E4. Please open a separate thread for your C2 to avoid confusions.
Yes I know it's for E4. I mentioned my camera for you to understand that I don't have any extra buttons and If it's possible to use temp bar as a slider, didn't ask for someone to do it for me. I'm new to this cameras.
Last request is using your Advanced 3.12 how can I get rid of the startup message and that yellow spot?
Anyway I will stop posting here (in this tread) if I bother.
Thanks to all for contributions.
LE: could someone provide me a full backup of E4 camera (FlashBFS, FlashFS, FlashIFS(no pic inside))? SN could be removed from files, I don't need any SN. Thanks
-
Sorry I have no clue what that yellow spot is...must be specific to C2 camera. This package is for E4, i have no knowledge using it on any other camera.
As I explained from the beginning on page 8 the splash screen is a reminder that no firmware update should be performed, you will have to live with it if you want to use E4 liberation package.
-
Hey Bud, look what I found with Spirit right this moment. This is on my E4 wifi advanced package and spirit down arrow key press to open his custom menu. When I hit back to close his menu, I'm stuck with this screen and the down button nor any other button will dismiss it. Have to reboot the camera, since even after killing Spirit's exe process the down button would work
My guess is Spirit's menu steals the focus from this popup that is why you can't close it. You have to work with Spirit to resolve this key press conflict. Better use a non modded camera for your tests.
-
Anyway I will stop posting here (in this tread) if I bother.
There is lots of newbies coming here for information on E4, mixing camera types in one thread may confuse them. Better keep it separate.
-
My guess is Spirit's menu steals the focus from this popup that is why you can't close it. You have to work with Spirit to resolve this key press conflict. Better use a non modded camera for your tests.
What I'm saying is that isn't your startup splash screen as we know it. I still get your splash screen at startup that automatically go away after a few seconds, and I've never seen the one I just show you.
On top of not being able to bring that screen up under normal use of my E4, I can't even dismiss it using the down button after shutting down Spirit's process and having the camera working properly, which seems to point to a remnant from your beta versions that was forgotten in there. Any reason why this popup would still be there while normal operation of the camera would never bring it up ?
-
As I said, most likely Spirit's application grabs focus and does not retun it to that popup when you shut down Spirit's application. Any key presses are passed to the screen element that has current focus. If the popup loses focus it can't process key press events. You are trying to layer an application on top of other application on top of main application. My recommendation is - test your stuff on a non modded camera to prevent interference.
-
good afternoon . Please explain in more detail the last points of hacking. stuck on them . 9-10 . firmware 3.9.0
------------------------------------------------
9. With Telnet and FTP connected:
a) In Telnet enter this command:
stopapp
b) Using FTP program rename FlashBFS\system\common_dll.dll on the camera to common_dll_org.dll
10. Transfer the new common_dll.dll from the working folder to the camera -> FlashBFS\system\
------------------
9. in my case PuTTY does not respond to the stopapp command. node 192.168.0.2 is available . ping o.k.
although PuTTY and FileZilla see FLIR E4. I have known this program before.
PS . unfortunately google translator confuses me
-
in Cmd type the following: telnet 192.168.0.2 (or whatever your camera ip is)
Telnet has to be enabled on your computer, you can google how to do that
-
@sata-sata. google "fubar e4" and give it a read.
-
Anyway I will stop posting here (in this tread) if I bother.
There is lots of newbies coming here for information on E4, mixing camera types in one thread may confuse them. Better keep it separate.
OK,no problem.
Can you help me please with a full dump from E4, here or on PM. Thanks.
Solved that yellow spot, I had some other lines on my cfg file. That startup message is from facet.rcc, with other rcc files doesn't show up. I will investigate more.
.caps.config.direction entry
.caps.config.direction.sensorAccel entry
.caps.config.direction.sensorAccel.enabled bool true
.caps.config.direction.compass entry
.caps.config.direction.compass.enabled bool true
.caps.config.direction.lcdAccel entry
.caps.config.direction.lcdAccel.enabled bool true
-
As I said, most likely Spirit's application grabs focus and does not retun it to that popup when you shut down Spirit's application. Any key presses are passed to the screen element that has current focus. If the popup loses focus it can't process key press events. You are trying to layer an application on top of other application on top of main application. My recommendation is - test your stuff on a non modded camera to prevent interference.
I'll say it another way. How can we bring this never seen before splash screen up ? What are the buttons or conditions you've set to prompt this popup ? If you can't bring this popup up during normal operation of the camera, then what's the point of it ? Could it be a forgotten beta popup of yours ? If so, could we remove it since we already get the splash screen at startup ?
-
OK,no problem.
Can you help me please with a full dump from E4, here or on PM. Thanks.
Solved that yellow spot, I had some other lines on my cfg file. That startup message is from facet.rcc, with other rcc files doesn't show up. I will investigate more.
See here :
Here's the tree file from my E4 wifi with advanced package upgrade. I blacked out the serial number and SUID with XXX's.
-
See here :
Here's the tree file from my E4 wifi with advanced package upgrade. I blacked out the serial number and SUID with XXX's.
Thanks but doesn't help me. I want all files from FlashBFS, FlashFS, FlashIFS(no pic inside). Can you help with those?
-
I'm sorry again. in the basic instructions for firmware version 3.9.0 under item 9 a the following is written - In Telnet enter this command: stopapp. Putty does not know such a command. are there any mistakes here? can be so more correct - stopapp.bat?
Bud ! - google search "fubar e4" displays on other versions of hacking. where the stopapp command is not mentioned
-
run it twice
-
my log. Whether it is possible so to make?
PS. although it really did work the second time. Thank you WhiteAndBlue :)
here this point is also not clear to me. Please clarify .
9. b) Using FTP program rename FlashBFS \ system \ common_dll.dll on the camera to common_dll_org.dll
I do not understand what to do with the file. rename it or transfer it to the camera ?
-
here this point is also not clear to me. Please clarify .
9. b) Using FTP program rename FlashBFS \ system \ common_dll.dll on the camera to common_dll_org.dll
I use WinSCP
-
with the program, I'll figure it out. I do not understand what to do with the file. and what kind of file. rename it or transfer it to the camera? namely under item 9. b) of the instruction.
9. b) Using FTP program rename FlashBFS \ system \ common_dll.dll on the camera to common_dll_org.dll
sorry for the curve translation.
-
I'm guessing you should rename it in order to have a backup and to not overwrite the file.
-
Rename it on the camera and leave it there. This is a system file and delete does not always work. Renaming always works. You rename it in order to be able to copy the new common_DLL to the camera.
-
if I understand correctly, then the file common_dll.dll in the Flir e4 file structure needs to be renamed to common_dll_org.dll. and nowhere to carry it. this is done in order to be able to put the modified common_dll.dll file from the computer there. I'm right ?
-
Yes
-
As I said, most likely Spirit's application grabs focus and does not retun it to that popup when you shut down Spirit's application. Any key presses are passed to the screen element that has current focus. If the popup loses focus it can't process key press events. You are trying to layer an application on top of other application on top of main application. My recommendation is - test your stuff on a non modded camera to prevent interference.
I'll say it another way. How can we bring this never seen before splash screen up ? What are the buttons or conditions you've set to prompt this popup ? If you can't bring this popup up during normal operation of the camera, then what's the point of it ? Could it be a forgotten beta popup of yours ? If so, could we remove it since we already get the splash screen at startup ?
Why is so much concern about something that never shows up in normal operation by your own words. Being a purist is not something that makes sense with E4 , in fact the whole E4 update became possible exactly because the manufacturer left low hanging fruits in the code here and there which were found and used for mod-ing. Take it as a test code or an Easter Egg, there is plenty of time before the Easter - if you won't figure out the buttons combination by then I will tell.
-
As I said, most likely Spirit's application grabs focus and does not retun it to that popup when you shut down Spirit's application. Any key presses are passed to the screen element that has current focus. If the popup loses focus it can't process key press events. You are trying to layer an application on top of other application on top of main application. My recommendation is - test your stuff on a non modded camera to prevent interference.
I'll say it another way. How can we bring this never seen before splash screen up ? What are the buttons or conditions you've set to prompt this popup ? If you can't bring this popup up during normal operation of the camera, then what's the point of it ? Could it be a forgotten beta popup of yours ? If so, could we remove it since we already get the splash screen at startup ?
Why is so much concern about something that never shows up in normal operation by your own words. Being a purist is not something that makes sense with E4 , in fact the whole E4 update became possible exactly because the manufacturer left low hanging fruits in the code here and there which were found and used for mod-ing. Take it as a test code or an Easter Egg, there is plenty of time before the Easter - if you won't figure out the buttons combination by then I will tell.
It's simply because of the few 4 buttons that are "free" as in they do not prompt any command of the E4 while in regular display mode, we need to be able to use them all for the implementation and it's hard to debug when I fall into that loop due to the popup. I'm all for giving you and the community credit for the E4 liberation achievement and hard work, and I don't mind having to deal with popup and splash screen, however I don't expect to have to deal with popup coming out of nowhere and serving no apparent purpose. I'd rather be working with all of you to make this as good as possible, so that's why I'm asking if this popup serve a purpose the way it is right now and if so, if we could move it to the startup or somewhere obvious for the users to actually see it under normal operation. If not, then I'll treat it as a remnant of a beta version and try to delete it or block it since its interfering with further development for no reason. That's why I'm asking you (plus the popup you wrote also say to come here for technical issues).
Thanks
-
did not pass the basic hack. The situation is the same as in the 245 message.
https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/225/ (https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/225/)
While analyzing what might be the reason. backup copies are available.
from the regime of RNDIS I do not go out yet.
non-WiFi model
-
Most likely is the new conf was created incorrectly. Also make sure there is only one .cfc in the camera folder and that you did copy and replaced the old .cfc. All these things happened to people here before.
-
checked. conf.cfc the file in the structure is one. he's new .
Is it right that the files common_dll.dll and common_dll_org.dll are the same size?
-
yes same size.
did you put you camera serial number in the config before encrypting? Not SUID, but S/N .
-
apparently I was wrong - I had to write a serial number (8 digits ) and I wrote down the catalog number (9 digits ).
re-read the topic learned that there are now serial numbers with 9 digits .
6. Open the supplied conf.cfg , scroll down to the very bottom to the line that starts with "# ID " and replace the 9-digit number with your camera serial number.
Save the file.
-
Take a deep breath, read the instructions again, especially step 6.
-
It's simply because of the few 4 buttons that are "free" as in they do not prompt any command of the E4 while in regular display mode, we need to be able to use them all for the implementation and it's hard to debug when I fall into that loop due to the popup. I'm all for giving you and the community credit for the E4 liberation achievement and hard work, and I don't mind having to deal with popup and splash screen, however I don't expect to have to deal with popup coming out of nowhere and serving no apparent purpose. I'd rather be working with all of you to make this as good as possible, so that's why I'm asking if this popup serve a purpose the way it is right now and if so, if we could move it to the startup or somewhere obvious for the users to actually see it under normal operation. If not, then I'll treat it as a remnant of a beta version and try to delete it or block it since its interfering with further development for no reason. That's why I'm asking you (plus the popup you wrote also say to come here for technical issues).
It is all yours, feel free to make any updates, but try to keep ebay resellers at a distance, that is - leave the startup splash screen alone.
-
It's simply because of the few 4 buttons that are "free" as in they do not prompt any command of the E4 while in regular display mode, we need to be able to use them all for the implementation and it's hard to debug when I fall into that loop due to the popup. I'm all for giving you and the community credit for the E4 liberation achievement and hard work, and I don't mind having to deal with popup and splash screen, however I don't expect to have to deal with popup coming out of nowhere and serving no apparent purpose. I'd rather be working with all of you to make this as good as possible, so that's why I'm asking if this popup serve a purpose the way it is right now and if so, if we could move it to the startup or somewhere obvious for the users to actually see it under normal operation. If not, then I'll treat it as a remnant of a beta version and try to delete it or block it since its interfering with further development for no reason. That's why I'm asking you (plus the popup you wrote also say to come here for technical issues).
It is all yours, feel free to make any updates, but try to keep ebay resellers at a distance, that is - leave the startup splash screen alone.
We got around to avoiding the conflict with the popup for now, idk if it'll surface again in the future but as of now it's not interfering anymore. Startup splash screen totally deserve to be there.
What we are developing is a sort of extra menu that will allow to toggle custom features on/off and use the left/right arrow buttons to adjust a chosen setting instead of always having to reach it trough the dash bar menu. Spirit is doing a great job and I'm testing it on the E4.
-
overwritten the config file with a serial number (8 digits). encrypted and replaced only it in the e4 directory. and everything worked EXCELLENTLY. temperature resolution 320 to 240. :-+
and solve the last stupid question - if I exit the RNDIS mode, the break will remain in place?
ps. Bud , I would like to thank you with a small share. but it is not familiar with the crypto currency. if you have a purse, please send his address PayPal in a personal message. thanks again .
-
Hello, I succesfully did the hack on 3.12 wifi and it works great. I have done it on win 10 64 bit. The only issue is I cant connect to camera via wifi. Camera connecting to the network but I cant connect with Filr tools both on PC and mobile. I am also wondering what is Recording mode with single shot option and how to record video ? I am also willing to say thanks via paypal ;)
-
I do not use Flir tools and do not know if it can connect to the camera via WiFi in the first place. Yoju can roll the change back to factory configuration and check. The package has nothing to do with networking. The Single Shot option is just that, single picture take when you press the trigger. If you install the Advanced package, there will be more options there.
You can't take videos with E4.
-
and solve the last stupid question - if I exit the RNDIS mode, the break will remain in place
RNDIS mode does not affect the modification.
-
Hey Bud, question about the USB mode on the E4 "hidden" menu (if you go to Device settings>Camera information and then hold the right button for a few seconds) the USB mode menu shows several options to choose from UVC, MSD, RNDIS, and several combinations of the above. However on my camera E4 wifi, the selected mode is UVC+MSD and it won't allow me to choose another setting, like RNDIS or RNDIS+UVC+MSD, etc. any idea why ?
-
Yes, the manufacturer deactivated that menu long time ago. You cant use it.
-
Yes, the manufacturer deactivated that menu long time ago. You cant use it.
Any way to restore it ?
-
Not as i know of. Other people tried too. It is not a big deal, once the camera is set up it is not needed to switch between access modes.
-
I just thought it'd be cool if you could do RNDIS and all the other modes all together simply by plugging the USB without having to run the fif file. Since the camera by wifi connection does the 3 functions right away, why USB wouldn't be able to do it too ?
-
Sorry which functions?
-
I've Flir E4 v3.9.0 without Wi-Fi.
I've switched to RNDIS using the http://fubar.gr/hacking-the-flir-e4/ (http://fubar.gr/hacking-the-flir-e4/) and using the "Set_RNDIS_permament.fif" file.
I've followed the post "Basic update package for E4 2.0L WiFi fw v3.9.0"
https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1336326/#msg1336326 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1336326/#msg1336326)
and applied the resolution and menu hack, the hack was apparently working.
But after powering up the Flir E4 I had a problem, the second submenu for choosing the type of images (MSX, camera, thermo, etc...) was disabled and i was stuck with only plain thermographic images.
I tried to revert all change by using the backup but now the Flir E4 initially seems to boot normally but it got stuck in the second half of the booting process when the blue bar is completing.
The blue bar seems to grow very slowly to the right but even after 30 minutes it still here.
I've still ftp access to the Flir E4 device but i don't know what to do :'(
I've attached the photo of the stuck Flir E4.
I've tried to put back the modified common_dll.dll and conf.cfc but even if i have the resolution hack back the booting still get stuck in the middle :(
About the "Recovery procedure" i should upload all the files or only the ones that I've modified/overwritten?
I have only uploaded the overwrittten files and deleted the added files.
-
i was stuck with only plain thermographic images.
This is an indication of the config file not loading. Yoh have to go back and carefully redo the config. You have the same problem as user sata-sata a few posts back.
-
i was stuck with only plain thermographic images.
This is an indication of the config file not loading. Yoh have to go back and carefully redo the config. You have the same problem as user sata-sata a few posts back.
Preparing the config I had wrongly used the P/N instead of the S/N |O
Now after the "Recovery procedure" I've successfully liberated the Flir E4 using the "Basic update package for E4 2.0L WiFi fw v3.9.0" ;D
Bud thanks a lot for your hard work and the support given.
-
Sorry which functions?
Ftp/telnet ip control, mass storage device and video signal
-
It may have to do with USB profiles, I am not a USB expert. However i experimented with each of the modes and ended up with hard bricking the camera, so i recommend not to use anything other than rndis and msd+uvc. That hidden nenu is more of an annoyance than anything useful. All it can be used for is to check what mode the camera is currently in.
-
Could we get RNDIS+MSD+UVC instead of just MSD+UVC ?
-
I think that was the one which bricked my camera.
-
I see. Thanks.
-
Ok, i've gotten through the Basic 3.12 liberation up until point 16 where i'm transferring the remaining files over. The file ui_control.rsc causes my camera to no longer boot fully. It gets a hi res image upon boot, but when the progress bar is about 2/3 full, the screen goes blank and not until i remove ui_control will it again boot fully. Any ideas?
The screen will go from live image with the gelding blue progress bar to black screen with progress bar. The progress bar will make it across although slowly and the shutter will cycle as normal for a while then quit. If I leave it alone for an hour it stays black with a full progress bar.
All the other files load with no issues, it’s just the UI_Control.rsc that causes it to fail to boot. As soon as I remove the UI_control it boots just fine.
-
It is required for full functionality. If you leave the old one you can only have resolution mod. Extended menu and anything else will not be there. Try removing the battery for a minute before you boot after the change.
Alternatively you can try to downgrade to 3.9.0.
-
So remove the battery longer than a few seconds? Ok I can try this. Once you get past getting into RNDIS mode and modding the conf files the rest is easy peasy.
Edit: All is good. Working fine now. Is there any way on these to unlock the higher frame rate of the EXX series?
-
Is there any way on these to unlock the higher frame rate of the EXX series?
Short answer: No.
Long answer: Yes.
Is it available? No.
Do you have to do it yourself? Yes.
Is it easy? Absolutely not.
How? Reverse-engineer the FPGA bitstream. Probably create your own to replace it.
-
Bud and the others that worked so hard to make this possible, Thank You! I've just finished liberating an E4 Wifi 3.12.0 2.0L camera and everything went off without a hitch. I was able to do the entire process over wifi allowing me to skip the RNDIS steps and dependencies.
My vertical alignment is slightly off between the thermal image and msx. The thermal image being higher then the msx. I've seen some information in the older thread about adjusting this within the calib.rsc. Is this still the recommended method? Should I do this adjustment before applying the advanced or finish liberating then worry about calibration.
Once again thank you very much to Bud and everyone else that have contributed to this.
-
You can do the adjustment with the calib.rsc file, works great. I would do the advanced package first so you can use the digital zoom and all the other features (like fine MSX distances) to really help set the proper calibration values.
-
You set vertical alignment in menu using Object Distance option.
-
Someone is trying to reach me via PM but i am unable to reply, getting a message the recepient mailbox is full. you have to sort out your PM box problems.
-
Someone is trying to reach me via PM but i am unable to reply, getting a message the recepient mailbox is full. you have to sort out your PM box problems.
It's inbox that's full, based on what you just said. Not me btw.
-
Here is a version of the Basic Package for E4 WiFi 2.0L, fw v3.12.0
I do not have a 3.12.0 device, so this version has not been tested.
YOU TRY AT YOUR OWN RISK.
=============
Update: Advanced Package is now available for testing
Thank Bud for this packages! I'm using the advanced 3.12.0 with my C2 and everything is working perfectly. But after modify my device the autorotation function is gone. Do you know how to reinstall or how to activate this function?
Best regards, Mogli
-
No i do not know. Try searching design_ui. xml if it has a autorotate setting.
-
Bud,
Thanks for the updated files. I was able to easily get Basic working on the 3.12.0 via wifi. I also tested Advanced, but that seemed to break most features: imageModeMenu was inaccessible/greyed out and the additional visuals (e.g. insulation, humidity, etc) were missing. I was able to revert back to Basic without any trouble.
The one thing I noticed that was different between your 3.9.0 Advanced and 3.12.0 Advanced deployments was that the 3.12.0 lacked an updated facet.rcc. I wasn't sure this mattered, but thought I would mention it.
-
There is no updated facet.rcc in advanced package. What you experienced had classic symptoms of config file not loading. Try removing the battery for a minute after you load advanced package. Others reported successful update.
-
Yeah, just got adv working after trying a second time and doing a few ui mods.
Thanks again!
-
brand new camera, 2.0L, 3.9.0
I followed instructions, everything went fine. Everything works great except temp scale(no manual mode, but i was able to bring lock mode back by editing .xml file).
-
So tell us what xml file and what you changed, thus may help others down the road.
-
I simply add one line from old toolbar-config to my camera toolbar-config.xml
In main manu tool bar:
<ToolBar name="scaleMenu">
<ToolBar name="scale_auto"/>
<ToolBar name="scale_scale_manual"/> <----- this line doesn't work for some reason
<ToolBar name="scale_lock_scale"/> <----- I add this line and got back lock mode on my camera
</ToolBar>
And I also modified measurements menu because other lines seems to be not working
<ToolBar name="measurementsMenu">
<ToolBar name="measure_spot_hide"/>
<ToolBar name="measure_spot_center"/>
<ToolBar name="measure_spot_max_box"/>
<ToolBar name="measure_spot_min_box"/>
<ToolBar name="measure_delta_s"/>
<ToolBar name="measure_delta_t"/>
</ToolBar>
By the way there is working manual scale option in picture edit mode...
-
scale_lock_scale is not the same as manual scale. Also it was removed on purpose because it did not retain the setting and worse - was screwing up
Presets Palettes menu. Carefully test your camera to make sure that line does not cause problems.
because other lines seems to be not working
Again you are not saying what was not working for you. Please learn to give full context to make your posts useful.
-
scale_lock_scale is not the same as manual scale.
I didnt say it is the same. I said I add lock mode to my camera menu which had no such mode after hack.
Also it was removed on purpose because it did not retain the setting and worse - was screwing up Presets Palettes menu. Carefully test your camera to make sure that line does not cause problems.
I see no problem with it so far.. But if you help me with manual mode, I'll appreciate it.
-
Not sure where you can look for the manual mode. I'd think there is no reason for it not to work if the firmware version was the same as dozens of users had here. You could try to flash 3.12.0 downloaded from Flir web site to eliminate hypotetical possibility of regional subversions of the firmware.
-
Ok, so I ventured out into the dangerous lands of FLIR hacking. Upgraded our 2.0L 3.5.0 camera to 3.9.0 and tried the basic procedure from page 8. I got as far as step 12, but something very unfortunate must have happened because now the camera boots to a point where it says "Application appcore.exe a serious error and must shut down". It's not something I've seen mentioned before and I'm lost. Is there a way to completely restore an installation of the camera system? Can I force an upgrade? Or is the camera completely bricked? |O
-
Use the Recovery procedure from page 8 to gain access to the file system, then restore the original files.
-
Thanks. With some tinkering, that did the trick. I got the tweak up and running. Amazing difference. Thanks for your excellent work.
One small issue. I can't seem to get the camera out of RNDIS mode and back to basic USB connection. I've tried to "fif" the camera through the FLIRInstallNet app, but to no avail. It keeps connecting as a network device. Any ideas?
-
Which fif you tried?
-
I repeatedly tried the "Permanently remove RNDIS" to no apparent avail, but I guess the real issue was that I didn't cold-boot the camera. After a battery removal the USB was back. Sorry to waste your time. :-)
best
-
Easter is coming and following my earlier promise here is how to activate a little hidden message:
-switch the camera Image Mode to Digital Camera,
-press and hold the Down key for 6 sec.
;)
-
We can do it ! Yes, we can.
Now I have to try every menu setting for 6 sec. !
Happy Eastern.
-
No new firmware for six months.... :o
-
No new firmware for six months.... :o
What's that about ?
-
3.12 was half baked and seemed to be an intermediate firmware version. I was expecting a new logically complete version. Maybe we will see a major rewrite of the security portion of it.
-
The Ex series is now quite old. I would not be at all surprised to see a new model released soon that runs Linux, like the new Exx series cameras. FLIR will not waste resources on a near end of life product.
Fraser
-
I have a E4 with 3.12.0. I downloaded the basic 3.9.0 and advanced 3.12.0. I don't see the cfccfg_v2.py (or cfccfg.py) python script in any of the archives. Could someone please point me to where I can find it?
-
I have a E4 with 3.12.0. I downloaded the basic 3.9.0 and advanced 3.12.0. I don't see the cfccfg_v2.py (or cfccfg.py) python script in any of the archives. Could someone please point me to where I can find it?
Hello Abvelv,
I uploaded the file for you. I don't remember the link I used to download it. I search the Forum but couldn't find anything.
It is not my file, credits belong to the creator who I thank for his work too.
http://www.mediafire.com/file/nbrba1brtbfsazt/cfccfg_V2.rar (http://www.mediafire.com/file/nbrba1brtbfsazt/cfccfg_V2.rar)
I own the E4 non WiFi HW 2.0L and FW 3.12.0 which I successfully liberated to the Basic at first and then to Advanced package.
I would like to express my Thanks to Bud for his hard work which made this possible.
Thanks a lot BUD!!!
-
Hello Eevblog Community
I have read a lot about the upgrade of E4 Camera
I own a E4 2.0 L 3.12.0 with Wifi.
I would like to ask: Is it possible for a person who doesn't have great knowledge in programming to do this upgrade?
I am only interesting in the Resolution upgrade.
Best Regards
Albert
-
Hello Eevblog Community
I have read a lot about the upgrade of E4 Camera
I own a E4 2.0 L 3.12.0 with Wifi.
I would like to ask: Is it possible for a person who doesn't have great knowledge in programming to do this upgrade?
I am only interesting in the Resolution upgrade.
Hello AlbertF,
There is no need to know programming at all, you just follow the instructions as given by Bud.
You must have a basic understanding of Telnet and ftp connections.
Have in mind there is no guaranty that you will not brick your camera if you do something wrong.
Regards
P.
-
Just wanted to pass on a quick story and take the opportunity to say...
Thank you, Bud!!!
I recently got my E4 back from Flir repair and found it had firmware 3.12.4 installed. :scared:
Well upon connecting it to Flir Tools and clicking "upgrade" in the initial pop up window I was prompted to "upgrade" the camera to a newer version. Which just happened to be 3.12.0, the camera auto downgraded itself. :)
Imagine my surprise and happiness. You can all imagine what happened next.
Thanks again to everyone. Hope this helps if someone runs into a camera with 3.12.4 installed.
-
I have an E6 with sw 3.9 and hw2.0L, I use E4 3.9 file to hack my e6 (I did not notice the prompt ).
After I run the basic cracking process and advanced cracking process, I found that the resolution was not cracked and there was no room function.
So I implemented the recovery program (it‘s sad that I only backed up the FlashFs and FlashBFs folders). First, I restored the file that modified by the advanced package. as a result, the thermal image showed a lot of noise and only the outline was visible(no msx). Then I continued to restore file that modified by the basic package , as a results ,i can't see any hot images, only the full screen noise.
Then I downloaded all the files again by ftp , and compared all files with the backed up file by binary, I found that only a few files in \FlashFS\system\journal.d folder are different, I tried to use the backup files to recovery , but No improvement. It's so sad.
Immediately afterwards I tried to restore the factory settings and upgrade to version 3.12, but without any effect, I could not see any thermal images and the camera did not respond to the heat source.
I continue to try to downgrade to 3.9, but the downgrade failed, stuck in the boot logo interface,i backed up all file with 3.12 this time.
After that, I used ftp to overwrite all of the file, and I tried to revert to 3.12 again. Thankfully, I was able to enter the interface normally, but there is still no thermal image.
My E6 is bricked. Someone has suggestions for repair? Is this a system failure or a motherboard failure?
-
I’m not quite sure as to your solution, but this unit most likely isn’t bricked.
-
The sensor calibration files are gone, you're seeing raw fixed-pattern noise. I have no idea how you managed that, but it has to go back to FLIR for repair recalibration.
-
Thanks for your reply. Can I replace the sensor calibration file with the same device file?
-
Only if you made a backup of the original. It's unique for each camera.
-
Thanks again, where is the original calibration file? Is calib.rsc? I backed up FlashFs and FlashBFs. The two folders on the device are the same as the files I backed up.
-
I have the original file in FlashFS and FlashBFS. I think the file is not damaged or gone. The files on the device are the same as the files I backed up.I have no way at all.
FlashFS\system\maps\ds_we_ap_fi_le_LCFMap.fff
FlashFS\system\maps\ds_we_ap_fi_leExFOL7_LCFMap.fff
FlashFS\system\maps\ds250C_we.crs
FlashFS\system\maps\ds250C_we_ap_fi_le_static.gan
-
Try turning it off, removing the battery, and waiting for about an hour. I believe this saved a camera with a similar issue before once.
-
Only if you made a backup of the original. It's unique for each camera.
After I've covered all the files, the only difference is that after booting, the default_a folder is created. There are inital.rsc and stats.rsc files, and then about five files in journal.d are modified:
FlashFS\system\default_a\inital.rsc
FlashFS\system\default_a\stats.rsc
FlashFS\system\journal.d\default.rsc
FlashFS\system\journal.d\default_services.rsc
FlashFS\system\journal.d\journal.rsc
FlashFS\system\journal.d\journal.rsc.old
FlashFS\system\journal.d\default_services.rsc
Do you have an idea? Can you help me look at it? Is it caused by these files? thanks!
-
Try turning it off, removing the battery, and waiting for about an hour. I believe this saved a camera with a similar issue before once.
As you said, I removed the battery and waited for about 3 hours. However, it is still full screen noise. The difference is that the displayed temperature range is about 20 degrees Celsius lower than before.
I will try to delete the following file
FlashFS \ SYSTEM \ default_a \ inital.rsc
FlashFS \ SYSTEM \ default_a \ stats.rsc
Then turn off the battery and try to wait 1 hour more again.
Do you have any other suggestions?thanks!
-
Lens geometry correction is gone as well. I'm out of suggestions, beyond restoring it to the original and cold booting it. You might have to send it back to FLIR.
-
Thanks for your patience!
In order to restore the original state, do I need files other than FlashFs and FlashBFs?
I can only try it myself now. God bless me!
-
Ok, so I ventured out into the dangerous lands of FLIR hacking. Upgraded our 2.0L 3.5.0 camera to 3.9.0 and tried the basic procedure from page 8. I got as far as step 12, but something very unfortunate must have happened because now the camera boots to a point where it says "Application appcore.exe a serious error and must shut down". It's not something I've seen mentioned before and I'm lost. Is there a way to completely restore an installation of the camera system? Can I force an upgrade? Or is the camera completely bricked? |O
Bloody Windows. Why they did not use Linux I don't know. Win CE has caused me nothing but trobble from the devices I have used it on. Plus its compaterbility is terible with other applications.
-
If it had not been Win CE, the people in this and other threads would not have enjoyed their E4s.
-
If it had not been Win CE, the people in this and other threads would not have enjoyed their E4s.
True, Microsoft does not have a good history when it come to secureity. It is only recently they have pulled their fingers out their asses and actualy address security issues.
-
I was having issues with our E4 at work always calibrating or not displaying correctly which would require a reboot. So I updated it yesterday and the cursor and image mode disappeared. Finding this forum made me realize we had the resolution hack (we bought it direct from flir, I do not think it was a refurb or anything but who knows). So I went ahead and used Bud's files to update our E4 1.2 hardware 3.12 Firmware flir. I read most people suggested not doing this. After doing a diff on my conf file and Bud's I found nothing that was specific to 1.2 vs 2.0 hardware. Had no problems and now have a flir that doesn't lag or glitch out and is feature rich. So Bud's files work for 1.2 and 2.0 Hardware. Thanks to everyone in this thread, it was quite a read. I made an account to just to leave my experience since this helped so much.
-
Dear Bud. Thank you so much for the hack. I hacked my E4 with hardware 2.0L and firmware 3.12 successfully
Thanks again!!!!
-
Thanks so much bud. Made an account just to say that! Sending some ether your way.
I did struggle longer than expected lol, and I use these tools daily at work and still had some idiot issues.
for newcomers trying this:
Got stuck on the trying to get it into the virtual FTP mode for about 30minutes. FLIRinstall.net was detecting only a "Ethernet IP etc "
Couldn't even connect to it with FTP? Ending using only wifi for all needed steps.
Also Got stuck on the pyton part, remember to put in the absolute path as mentioned earlier in the thread.
Windows 10 64bit
Used WIFI only
3.12.0 HW 2.0
-
Hello Bud,
Received my Flir E4 a few days ago from Reichelt Germany version 2.0L and 3.5.0 firmware
Followed the instructions on page 8, both basic and Advanced, worked as described.
My serialnumber has 8 digits, this confused me a bit because of changing a 9-digit number in the conf.cfg file, but using the 8-digit number did the trick.
Used Windows10 64Bit 1803, no issues oher than after disconnecting/rebooting the unit, my system didn't connect correctly to the unit in RNDIS mode.
To solve this, open 'Network Sharing Center via setting, and then open ' Change Adapter settings', select the (virtual) Ethernet adapter and right-click Diagnose.
After a while it end with an error that no ip-adres is available, just close the window. Go into Putty/FTP and reconnect, it will work now...
Again, Thanks !!
Bart
-
Well crap...it looks like my 2.0L with 3.13 did not like the hack. I'm trying the recovery process and can't even get that to work. I can connect with the flirinstallnet program and run the set rndis temp fif file. It says
Connected
Installation started...
Camera command usbfn RNDIS
Timeout waiting for camera response
Camera update completed
It never get's an IP that I can find. Is there another step I'm missing?
EDIT: I'm back in. I just had to restart my computer after installing the software... :palm:
EDIT2: Ok I put the original common.dll back in place (renamed it) and I'm back in action. I know the one is this thread is from 3.9. Do I need to get a more recent version somehow?
-
I do not have a 3.13 update package. If you can make a backup copy and post a link, i can take a look when have time.
-
Here is a copy of the backup. I don't think I missed anything. Thanks for looking into this!
https://www.sendspace.com/file/zysp7y (https://www.sendspace.com/file/zysp7y)
-
Thanks for the files. The commondll.dll is fully identical to the one from v3.12.0. You should try the update package for 3.12.0 from post #478.
-
Dear Bud. Thank you so much for the hack. I hacked my E4 with hardware 2.0L and firmware 3.12 successfully
We do not hack, we liberate. Hacking is an act of vandalism, Liberation is a mission!
:D
-
I didn't really play around with the camera before liberating it. Is there a place I can confirm that it's 320x240 now other than picture quality? I didn't see anything in the menu.
-
FLIR Tools shows you the true IR resolution in the picture information box. Normal picture viewers state 320 x 240 pixel image size, even before the upgrade due to camera upscaling.
Fraser
-
Thanks Bud and Fraser. They must have changed something. I've redone the cfc twice and uploaded the dll twice now and I'm still stuck at 80x60. The 3.12 does allow the camera to boot though.
-
Make sure you delete the original dll and conf.cfc from the camera. Just renaming and leaving them there is not enough.
EDIT: you can check if the new config was loaded or not by checking if the camera still has MSX mode. It was seen before by others that the camera loses MSX if the config did not load at boot.
-
That did the trick! Version 3.13 is officially liberated! Thanks Bud!
-
Thanks for confirming! Did you load both Basic and Advanced options?
-
I did just the basic options and everything seems to work. I'm just using this to site check the houses I build, so nothing too fancy.
-
So the indications are the camera manufacturer is not bothered by what is hapenning. Many thanks to them and hopefully this will last for the hext little while and let more people enjoy the technology :-+
-
It was a battle they lost long ago and the resources to prevent the upgrade were assigned for a good while. I suspect it will just be a case of the next generation cameras running Linux and a more secure configuration. FLIR have never told me that they were 'angry' about the upgrade. It revealed a security weakness in their cameras that needed to be considered in future. They did take some action to reduce the ease with which a camera may be upgraded and that appears to be enough to control the 'spread' of such activities and limits it to those brave enough to take the risk.
Fraser
-
Thanks for the note Fraser. It does make sence to tighten security in next generations and for "specialty" type of markets, in case of cameras getting in wrong hands.
-
I was in the market for a camera, but I was pretty much set on buying a used one to get a better quality that was still in my budget. If it wasn't for the upgrade, I would never have bought a new flir let alone an E4. I only found out about this because of the eBay sellers. I wasn't going to pay someone a $250-350 premium, just to modify and replace some files though. :wtf:
-
I am new to the forum and am interested in learning about the E4 hack. I have not purchased the camera yet. is there anything to look for when buying an E4 that you plan to hack? is there a link to info to read prior to starting the process?
-
I just bought a new one off of Amazon. It's pretty straightforward. Just get the upgrade package version that matches your firmware. Look at the previous page where my posts start for information on the latest firmware. Just make sure you do a full backup first. If you download the upgrade package, there are instructions included in there. Take a look and see if it's something you feel like you can handle. You don't need to be a computer genius to pull it off. You just need to be able to handle some pretty basic command line and have a basic understanding of how to navigate a file system.
-
Hey y'all
I read this entire thread, all 28 pages, and I have a pretty good grasp of the upgrade process.
The issue is, I have an E6, and I cannot find anything regarding that (except warnings to NOT use this on anything but an E4).
Is there a similar thread for the E6? I haven't been able to find it, and would be very grateful if someone could point me in the right direction (Or maybe I'm just out of luck and the E6 can't be upgraded?)
-
I helped a buddy do an E5 and the upgrade process was the same exact as the E4. Keep a backup, esp of your common_dll.dll and conf.cfc and you shouldn’t have any worries.
-
Hey y'all
I read this entire thread, all 28 pages, and I have a pretty good grasp of the upgrade process.
The issue is, I have an E6, and I cannot find anything regarding that (except warnings to NOT use this on anything but an E4).
Is there a similar thread for the E6? I haven't been able to find it, and would be very grateful if someone could point me in the right direction (Or maybe I'm just out of luck and the E6 can't be upgraded?)
I am upgraded my E6 according to the E4 upgrade method two months ago. Unfortunately, E6 was completely bricked, and the thermal images disappeared. Fortunately, my camera was still under warranty, so I sent it back to FLIR and they repaired it for free. So, please don't do this before the E6 cracking method comes out. :palm:
-
Is there a way to add a custom palette? I know overwriting an existing .pal file would work but the thumbnail and label in the toolbar would not match. Which part of the file system is this information stored?
-
It is hard coded in a dll or exe file, cant remember which one, and it may be one of those digitally signed files. Unlikely you can change it.
-
It is in XML menu that is pure text file so you can add whatever you want to it. Unfortunately in it put into applaunch.dat file with a CRC in the latest firmware and applaunch.dat is signed :( For the older versions, without applaunch.sgn (or whatever it is called) you can just copy your whatever.pal file to flashbfs and add a line to XML menu exactly like it is done for all other palettes. Not rocket science whatsoever...
-
You have not tried that, have you.
-
No, I haven't yet.
But now I can see, you can only use whatever is in facet_ui_qml.dll. There is more there than included in the menu and toolbar but choice is limited to whatever is there.
It probably could be circumvented with an external Qt resource file but that is not on my radar yet and I'm not a GUI/Qt programmer. I would like to add medical palette but that is very low on my list. The most wanted feature is working service menu and that's what I'm working on.
I'm not a Windows programmer either, have been with numerous Unix flavors for almost entire life.
-
I would like to add a few other palettes also but have found it just as good if not better to just create them outside the camera with post processing on the raw image. Using the raw image with Photoshop you can just create any gradient you want and apply it to the image.
-
You can still add whatever palette you want. It is just not possible to add it to the toolbar if it is not included in facet_ui_qml.dll.
Just look at flashbfs/system/appcore.d/factory.d/default_params.rsc where it loads iron.pal (or palette.rsc in flashfs/system/appcore.d/factory.d for older firmware.)
It might be also possible to add a different palette to a preset in a newer firmware (look at flashbfs/system/ui.d/presets/*.rsc.) I didn't try it -- lots of other things of higher priority -- but it might work. And if everything else fails it might be possible to just set .image.sysimage.palette.* resource branch with whatever you want using rset.
BTW, flashbfs/system/appcore.d/factory.d/ui_control.rsc reads MULTIPLE Qt external resource files by using "facet_*.rcc" and the same is true for menu design (" design_ui*.xml") that would probably allow adding additional properly named resource/menu design files with user elements.
I might be wrong but I have a strong gut feeling that those settings can be simply added to regular user config files...
-
You can safely forget about adding a palette by simple editing a XML file. You can edit it as much as you want but the palette will never appear in the menu. As I said, palette names are hard coded in a dll or exe. Anything that is not hard coded there will not work. Period.
-
This is exactly what I said in my last message. It is not possible to just add it to the menu because menu IDs are not in the facet_ui_qml.dll.
That does not mean it is impossible to load a palette without menu.
It does not also mean it is impossible to hack that DLL to add whatever one wants and also add resources with additional .rcc files. But that is definitely not something regular user can do.
There is also a reason why Flir included those 2 XML files and big .rcc file to their signed applaunch.dat file in 4.13.0 (3 last lines) to prevent changes to those files.
-
I own a Flir E4 1.2L (non WIFI model) with SW Release 2.11.0 (original, not hacked)
I read this thread several times, but there are still some questions open:
1) Should I upgrade to SW-Rel. 3.12.0 ? (Flir Tools offers this release...). Are there any significant advantages in comparison to 2.11. ?
2) I did the 2.11.0 update with FLIRInstallNet and the .fif file in the 2.11 update pack (eFLIRinstall didn't work under windows 10). It took nearly two hours to finish. Is there a faster method with an update pack?
3) In Bud's documentation for the update procedure for E4 is still mentioned "DO NOT USE.... OR CAMERAS OTHER THAN E4 2.0L". Is this still valid despite positive feedback about "liberating" a 1.2L camera from members (e.g. dandin87, reply #665) in this thread?
Sorry, if I missed something.
Thank you very much.
-
If you have Firmware 2.11, I recommend you hack that firmware and do not upgrade the firmware first.
2.11 is far easier to upgrade and manipulate. Later firmware does not offer any bug fixes, just different countermeasure types.
Fraser
-
You can still add whatever palette you want. It is just not possible to add it to the toolbar if it is not included in facet_ui_qml.dll.
Just look at flashbfs/system/appcore.d/factory.d/default_params.rsc where it loads iron.pal (or palette.rsc in flashfs/system/appcore.d/factory.d for older firmware.)
It might be also possible to add a different palette to a preset in a newer firmware (look at flashbfs/system/ui.d/presets/*.rsc.) I didn't try it -- lots of other things of higher priority -- but it might work. And if everything else fails it might be possible to just set .image.sysimage.palette.* resource branch with whatever you want using rset.
BTW, flashbfs/system/appcore.d/factory.d/ui_control.rsc reads MULTIPLE Qt external resource files by using "facet_*.rcc" and the same is true for menu design (" design_ui*.xml") that would probably allow adding additional properly named resource/menu design files with user elements.
I might be wrong but I have a strong gut feeling that those settings can be simply added to regular user config files...
Hmm does anyone know what the available options are in the facet_ui_qml.dll. Even better yet. How do you decompile the facet_ui_qml.dll, what software do you use?
-
I was able to make some sense of the dll. I used "Hex Fiend" and found this: (I don't think bw.pal/ color_gray is being used)
bwcold.pal
bwhot.pal
lava.pal