FLIR E4 Wifi Resolution and Menu Hack Thread

[Sebastian82]

Yes! As I said before, all by the manual. I also can see the conf.cfc has an effect on the camera. With the new one, MSX is gone and crosshair, too. I put back the old one (even with the new dll still on the cam), works like before with bad resolution but with image menu.

[KCT_99]

Try using your own cfc, decrypt it, change the resolution setting and noise setting only and then encrypt it again and try out without changing any menu features.

[Sebastian82]

Hi,
and thanks again for the help!
Do you have a link to a manual for me how to decrypt, change the settings and encrypt again?
Sorry I am noob!

[Bud]

Yes! As I said before, all by the manual. I also can see the conf.cfc has an effect on the camera. With the new one, MSX is gone and crosshair, too. I put back the old one (even with the new dll still on the cam), works like before with bad resolution but with image menu.

Your new conf.cfc does Not have an effect on the camera, based on your description. The symptoms you are experiencing indicate the conf.cfc is not loaded at all. You should focus on investigating why it is not loaded. This may happen if SUID is used in the conf file instead of the camera SN, or if you have more than one conf file on the camera in a same folder.

[Sebastian82]

Hey Bud!

Thank you for your help!
As I said before; when I copy and replace the original conf with the edited, the menu is broken. When I copy back the original again, it works. It is not affected by which dll I use.

I just double checked:

File I downloaded from you (thx by the way) # ID 6390XXXXX
I substituted with # ID 639082195
For the encryption I use python cfccfg_v2.py 40B9CF0200382C07 conf.cfg conf.cfc

I did not rename old dll or cfc but replaced them (overwrite).

I will try decrypting and encrypting the original file (attached) and keep you up to date if I find a solution!

Cheers and thank you!

BTW
I am a total noob when it comes to programming and hacking, but I am a thermographic freak 
We did some crazy stuff in the past:

https://tbi.eiif.org/projects/HKW/index.html
(This is a 42 megapixel thermographic panorama picture that has been merged with a 3D-point cloud. You have to go on the menu on the left hand side to switch channels.)

https://tbi.eiif.org/projects/DT360/tour.html
(this is a 25 megapixel thermographic panorama picture that has been combined with a 500 megapixel RGP panorama image, also calibrated.)

https://tbi.eiif.org/projects/EiiF/Viewer2805.html
(Interactive viewer where you can use a lever to switch between RGB and thermography. Works for every cam that has thermal and RGB lens, also with calibration in tool.)

Panorama pictures are geometrically calibrated and stored in full radiometry.

[KCT_99]

Sebastian,

this is my way of applying the Resolution mod only.

Once the resolution works for you, you can try applying the menu mod as per Buds suggestions.

[Bud]

As I said before; when I copy and replace the original conf with the edited, the menu is broken. When I copy back the original again, it works. It is not affected by which dll I use.

You MUST use the new conf only with the updated DLL.  Copying new conf to the camera that still has the factory DLL will get you the problem that you are having.

[Sebastian82]

Hi all,
as I said before, I used dll 3.16 and conf 3.12 together.
I also did it according to the manual that was delivered with 3.12 -basic.
I will try again but up to now I did all according to the manual... sorry for bothering you...

[Bud]

Make sure that the DLL was successfully replaced, by checking its timestamp on the camera. Maybe Filezilla quietly fails to replace the original one.

[Sebastian82]

Hi Bud,
It's a mistery... I checked it. Old dll was from 2020, new one from 2022... I will give it a new try with your manual tomorrow! Thank you!

[Bud]

When you copy it the timestamp will change to the current date/time.

Edit: also compare the size of the stock DLL and the replacement one. They must be the same.

[Sebastian82]

Hey guys,

I'm sorry to bother you again.
I did exactly according to your manual Bud, I even printed it out and used a textmarker like in school. I also wrote down every step I made and checked everything you two told me since yesterday, but the outcome is exactly the same... sorry...

1)   Switch on E4, connect via USB cable.
2)   Open FLIRInstallNet, select “Set_RNDIS_temporary.fif” and click “Run FIF”.
3)   Message appears “Connecting to IRCAM2195”.
4)   Serial number of my E4 is “639082195” so this is looking good.
5)   Using FileZilla 3.58.0 and connect to E4 by “192.168.0.2” with “flit” and “3vlig”.
6)   Full backup of the E4 to desktop. Opening FlashIFS/FLIRVers.rsc.
7)   .version.SUID text "40B9CF0200382C07".
   Downloading “cfccfg_V2.zip” from the link in the manual, extracting “cfccfc_V2.py” to C:\Python27.
9)   Copy “conf.cfg” from “Basic_3.12.0.zip” into Python27.
10)   Open with NotePad and change “# ID 6390XXXXX” to “# ID 63902195”.
11)   Leaving “# CRC03 11223344” as it is.
12)   Open cmd as admin, using “python cfccfg_v2.py 40B9CF0200382C07 conf.cfg conf.cfc”.
13)   Skipping the part with “Telnet” and “stopapp” because I have no Telnet installed, maybe this is the mistake? Or because I am using Windows 10 64 bit instead of Windows 7?
14)   Renaming “common_dll.dll” to “common_dll_org.dll” in FlashBFS\system\.
15)   Copying “common_dll.dll” from “common_dll_3.16.zip” into FlashBFS\system\.
16)   Checked time and date, went from 2020 to today (2022).
17)   Closing FileZilla. Disconnecting E4 from USB. Press and hold power for 6 seconds.
18)   Boot-up screen with “This camera etc.” appears as well as loading bar (no quick boot).
19)   E4 booted and is showing normal behaviour.
20)   Applying RNDIS temporary again.
21)   Reboot PC because E4 not connecting, leaving E4 running, connecting after the reboot.
22)   Copy new “conf.cfc” into FlashFS\system\appcore.d\config.d\ with “overwrite”.
23)   Checking: date and file size changed.
24)   Closing FileZilla, disconnecting USB, press and hold power for 6 seconds, remove battery.
25)   Switching on E4.
26)   No resolution upgrade, menu broken.

dlls have the same filesize, cfc is bigger than the original one.
I'm desperate 
I don't understand why this is not working. I attached the files to this post, maybe they are corrupted?  conf.zip (536.88 kB - downloaded 102 times.)
I will try again and if it not works, I will try de- and encrpyting the original cfc

Thank you guys so much for your help!

edit: tried the cfccfc instead of cfccfc_V2, cfc have different size but the outcome is the same: bad resolution and broken menu. when I copy back the old cfc but keep the new dll, bad resolution but working menu.
Put the original cfc as attachment  org_conf.zip (6.56 kB - downloaded 98 times.), maybe they did something new or a hack-protection?

[Sebastian82]

Hey fellas,

I managed to decrypt the original conf.cfc from my FLIR E4 2.0L with 3.16.0 firmware and noticed something odd:
I used "cfccfg.py 40B9CF0200382C07 conf.cfc conf.cfg":

Head:
#
# Generated at 2017-01-20 16:58:13
#
.caps entry
.caps.config entry
.caps.config.name text "app E4"
.caps.config.revision text "2.0"

Bottom:
# ID 639082195
# CRC03 971089ca
pNÀfyé¤p5¸1Ìée-l"6$fx„½žKQãP¨Bu!™‹$[™
¾aÌaÌd£air¬ßq¡Á)fòò„Å'g‚èÕi£ÈÛu Ì8öºàHyéH2xÒ#ÒÒ}& ;›¥Þ“å1)É[+z„‘p…¥ê-*­
ž½­·…µ_¹ ã>6‚*rÌxÅ™Ÿ…

Besides the bottom part, everything looks good. I thought maybe I fucked up the decryption but I could reproduce it tree times already.

I manually changed noise to "false" and "0" and resolution to "320" and "240".

Then I used "cfccfg.py 40B9CF0200382C07 conf.cfg conf.cfc" to encode conf.cfc.

Same problem...

Edit:
I did the same using cfccfg_v2.py and the strange fractured code at the bottom of the cfg did not appear. It ends like this:
# ID 639082195
# CRC03 971089ca

  BELIEVE IT OR NOT IT WORKED! THANK YOU GUYS SO MUCH! I WILL POST A DETAILED MANUAL! 

[Sebastian82]

Hybrid hacking method

FLIR E4 2.0L with 3.16.0 firmware, manual for noobs like me:

Believe it or not guys, I’m a noob, but I’m aware of it so I always go strict by the manual. Super frustrating because it took me 10 hours to figure out what was wrong. Went 100% by the manual and got a lot of help from Bud and KCT_99 (thx guys!) but it was an error I could not find in the forum, so I will post a very detailed manual. Until further, I will call it the “hybrid hacking method”, because it should work for every cam (with and without WiFi) and no matter the version.

Short version was; It was not enough to substitute the ID (6390XXXXX) in the hacked conf.cfg but also the CRC03 (11223344). To get the CRC03 I used the cfccfg_V2.py and decrypted the original conf.cfc, copied both, the ID and the CRC03 to the hacked conf.cfg and encrypted it again to get the hacked conf.cfc.

But now from the start:

1)   I used Windows 10 with 64 bit. No need for Windows 7 or virtual machine.
2)   Install the free version of FLIR Tools (I used the latest version: 6.4.18039.1003). You will need it anyway because it is a damn fine software which can open the radiometric JPGs from your E4 and change e.g. measuring spot, colour code, temperature rage, can separate stacked images e.g. MSX etc.
3)   Get FLIR Device Drivers (version: 1.9.1.0), I found it here in the forum.
4)   FileZilla Client 3.58.0 (I used the latest X64, obviously).
5)   Python 2.7.9 (also found it here in the forum links).

Now for the work:

6)   Connect your FLIR E4 via USB to your computer. Start “FLIRInstallNet.exe” from your FLIR directory (C:\Program Files (x86)\FLIR Systems\FLIR Tools\bin).
7)   Check if “Camera” shows the FLIR cam, otherwise you did not install the FLIR Device Drivers correctly.
   Browse for “Set_RNDIS_temporary.fif” (also here from the forum) and click “Run FIF”. A message should appear that it was successfully. Now the camera will be set for RNDIS connection until you cold-start it again. You can also go for the “Set_RNDIS_permanently.fif” but I had trouble getting it of my FLIR E4 again.
9)   Now “ThermaCAM Connect 3” should show a message “Cam connected via 192.168.0.2” or similar. If not, try to reboot your computer but leave the FLIR E4 on.
10)   If this worked, start your FileZilla, connect to the E4 by IP: 192.168.0.2 (or whatever the ThermaCAM Connect 3 showed you), User: flir and Password: 3vlig.
11)   BACKUP! The backup saved my ass! Just copy all files from your FLIR E4 to e.g. the desktop. After copying there will appear an error message that not all files could be saved, ignore that. At least backup three files:

- _\FlashFS\system\appcore.d\config.d\conf.cfc contains ID and CRC03
- _\FlashBFS\system\common_dll.dll
- _\FlashIFS\FLIRVers.rsc contains SUID
These three files are vital!

The tricky part:

12)   Go to _\FlashIFS\FLIRVers.rsc and open it with an editor. 2nd line after “.version entry” you will find: .version.SUID text "XXXXXXXXXXXXXXXX". Copy the 16 chars between the quotation marks.
13)   Go to your backup and copy the “_\FlashFS\system\appcore.d\config.d\conf.cfc” to your Python27 folder (like e.g. C:\Python27\).
14)   Copy the cfccfg_V2.py to the same folder.
15)   I opened CMD (command line) as administrator for it. Then go “CD C:\Python27” (CD is short for change directory) to reach the folder. Encrypt the conf.cfc with: cfccfg_v2.py XXXXXXXXXXXXXXXX conf.cfc conf.cfg where the X are the 16 digits (numbers and letters) of your SUID.
16)   Now in the folder there will a file appear that is named “conf.cfg”. Open it with the editor.
17)   On the very bottom you will find ID and CRC03. They will look like this:

# ID XXXXXXXXX (9 digits)
# CRC03 XXXXXXXX (8 chars, numbers and letters)

Copy both of them.

18)   Use e.g. the conf.cfg from the “Advanced_3.12.0.zip”. Open it with the editor and go to the very bottom. Insert your ID and CRC03, save it and exit.
19)   Copy the hacked conf.cfg where you just put in your ID and CRC03 into your Python27 folder, delete or substitute the one you encrypted from the original conf.cfc. Also delete the original conf.cfc in your Python27 folder. So now you only have your hacked conf.cfg in your Python27 folder.
20)   Again use CMD as admin, go to C:\Python27\ and now decrypt it with: cfccfg_v2.py XXXXXXXXXXXXXXXX conf.cfg conf.cfc remember to put in your SUID for the 16 X.
21)   Go with FileZilla to your FLIR E4 and copy the hacked conf.cfc to the folder: “_\FlashFS\system\appcore.d\config.d\”. Make sure FileZilla asks you to substitute the original conf.cfc and allow it.
22)   Now go to “_\FlashBFS\system” and substitute the “common_dll.dll” with the one you need. I used the hacked “common_dll_3.16.zip” from the forum.
23)   Close FileZilla, disconnect your FLIR E4 from USB, press and hold the power-button for at least 6 seconds (even if the screen turns dark after 2 seconds), remove the battery for a few seconds (e.g. 10).
24)   That should have done the trick!

If you get a broken menu like me, where the image options are greyed out and cannot be selected, it is due to the missing entry for CRC03 or the wrong version of the cfccfg.py (V1 makes a mess out of my conf.cfc and V2 works like a charm) . It looks like in older version you could keep the 11223344 and it was running fine, for me it always ended up with the broken menu and the low resolution.

So why is this called “hybrid”? Because you have another option I tested successfully!

a)   Backup everything.
b)   Open the _\FlashIFS\FLIRVers.rsc and write down the 16 digit SUID.
c)   Copy conf.cfc to C:\Python27\ and decrypt it.
d)   Open the conf.cfg you just made and check for the following four lines:

.caps.config.image.settings.IRwidth int32 80
.caps.config.image.settings.IRheight int32 60
.caps.config.image.targetNoise.enabled bool true
.caps.config.image.targetNoise.targetNoiseMk int32 125

Substitute the 80 by 320, the 60 by 240, the true by false and the 125 by 0. This will enhance the geometric resolution from 80x60 pixels to 320x240 pixels and the thermographic resolution by reducing the artificial noise (true to false) from 125 millikelvin to 0 millikelvin.

e)   Save the conf.cfg. Delete the conf.cfc in your Python27 folder, decrypt the conf.cfg with the cfccfg_V2.py to get your hacked conf.cfc.
f)   Copy the hacked conf.cfc to the config.d folder and substitute the original one. Also copy and substitute the common_dll.dll in the system folder.
g)   Switch off the cam and restart it.

Now you have “only” the increased resolution (geometric and thermographic) but this also worked fine for me!

Note that the most crucial codes you have to save are the ID, CRC03 and SUID. If you lose one of these tree, you have a mayor problem! Also backup at least the conf.cfc and common_dll.dll! I attached the files I used to this post! Good luck and have fun!

[KCT_99]

Good stuff. Congrats.
Na siehste, geht doch.

[Bud]

CRC value is irrelevant. First, CRC check was disabled in the replacement DLL. Secondly, as soon as you change anything in the conf file, the CRC value becomes different. Therefore copying the old CRC value makes no difference.

[Sebastian82]

Hi Bud,
jeah I thought so, too. But I tried it several times and cound reproduce it. I also encrypted the conf.cfc forward and backward. As soon as the CRC03 is 11223344 I have 80x60 pixels and menu bug.
I still have no WiFi or whatever. I copied all files from the "Advanced_3.12.0" but the menu looks the same, which is fine for me, as long as the resolution is 320x240 pixels and 0mk artificial plus the menu works 
Thank you two again!

[Bud]

For the sake of experimenting, you can try changing your CRC and trying that conf file. It should make no difference.

[Sebastian82]

Already tried that, when I go CRC03 to 11223344 I get the broken menu and lousy resolution.
cfccfg.pt made a mess at the ending of the conf.cfg with strange symbols. There I also got bad resolution + broken menu.
cfccfg_V2.pt made a correct conf.cfg but when I leave CRC03, same result, bad resolution + broken menu.
With cfccfg_V2.pt and my own CRC03 the resolution is enhanced + the menu works!
Can you please tell me what the "advanced" zip file will change when I put it on the E4? Is it more than resolution? I mean there are additinal files in the FlashBFS folder, what do they do?

[Bud]

I mean change just 1 character in your CRC.

[Bud]

Can you please tell me what the "advanced" zip file will change when I put it on the E4? Is it more than resolution? I mean there are additinal files in the FlashBFS folder, what do they do?

It was all described in my posts in this thread, with screenshots.

[Sebastian82]

Hey Bud, hey guys!
Sorry for my late replay!
I bought a second E4 from the same shop, same hard- and software.
This time your manual worked instantly. I did not need to decrypt the conf.cfc. But it is the same as with the other one, only the resolution hack is working. Even if I copy all files from your advanced.zip to the proper folder (I get asked by FileZilla if I want to substitute files) menu stays the same.
This is no problem for me because the menu of the cam looks like before the hack but the resolution increased
Have a nice weekend!

[agiorgitis]

Hey Bud, hey guys!
Sorry for my late replay!
I bought a second E4 from the same shop, same hard- and software.
This time your manual worked instantly. I did not need to decrypt the conf.cfc. But it is the same as with the other one, only the resolution hack is working. Even if I copy all files from your advanced.zip to the proper folder (I get asked by FileZilla if I want to substitute files) menu stays the same.
This is no problem for me because the menu of the cam looks like before the hack but the resolution increased
Have a nice weekend!

Something that may help you: Delete the files on the camera prior to sending the new ones. Don't let filezilla ask you to substitute the files on the camera.

I had similar issues like you in the past and I found out that in reality they were not being substituted. 

[Sebastian82]

Hi, thanks for the help!
I did the same with the conf and common_dll and both got substituted.
I had two exact same FLIR E4 and it worked on one, but not the other.
It is maddening I simply don't understand what is going on 

[Bud]

Do not know where you sourced the cameras but if they were not factory ones and had software upgraded or modified before, this could explain the weirdnesses you experienced. There would be no reason for a factory same software version to react differently to the liberation process.