Flir E40 Upgrade & Configuration

[ksilabs]

I uploaded it again, so it will work for 30 days again.
http://www.filedropper.com/flirexxpn490v22314updatepack

Got it, thanks.

[ksilabs]

I uploaded the original package flir_exx_pn645_pn646_v3.12.7_update_pack.zip here

durability 30 days
http://www.filedropper.com/flirexxpn645pn646v3127updatepack
and here
http://www.file-upload.net/download-10007428/flir_exx_pn645_pn646_v3.12.7_update_pack.zip.html


You can harmless copy the prodapp.exe and restartapp.bat to your E40 (service mode app, also for Web GUI)

see
https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg415480/#msg415480
and here for using rls
https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg400024/#msg400024

But a full firmware downgrade is risky.
Good luck!

Does anybody have this archive? Would you share, PLEASE?

Even just prodapp.exe from 3.xx.xx version earlier than 3.18.0 would be VERY VERY helpful.

Guys, PLEASE!, share that archive!!!

I simply can't believe nobody have it somewhere anymore...

OK, so far no results...

There were 2 guys here who supposedly had 3.12.7 update pack or backup from camera with that firmware. It turned out they don't have it anymore. The prodapp.exe binary from 2.xx.x versions won't start on 64xxxx Exx cameras. Binary from T420 won't start either. That means prodapp.exe from any earlier 3.xx.x version is needed.

I can't believe nobody has an earlier update or backup anywhere.

I would even pay a reasonable price for it if somebody has it but don't want to share. Please send me a PM or email if you happened to have that treasure.

[ksilabs]

Btw, the interesting thing is that there were multiple software releases after 3.12.B7 that followed the same new pattern (3.12B.7 was the last one after which that started.)

Forst release was 3.13 followed by 3.14..3.18, 4.1..4.13. What Flir officially released were X.YZ.0 versions (e.g. my 3.18.0 or current 4.13.0) that ALL have one thing in common -- they ALL had version 0 prodkit that is essentially the same bare minimum with all good stuff removed. All of them, starting with 3.13.0 and all the way to current 4.13.0.

However EACH AND EVERY of those releases also had a NON-ZERO minor number version that was kinda inconsistent within 3.13..3.18 (it was .8, .9, .10, .11, 12 for 3.xx series) but then it became .13 for all releases between 4.1 and 4.6 and switched to .14 for everything up to latest 4.13. That minor version is exactly the same as the minor version of NON-ZERO version prodkits included into particular release that was 4.0.0.X for all 3.xx software versions and became 4.1.0.x starting software version 4.1. For example, the latest publicly released crippled 4.13.0 software has its FULL sibling, version 4.13.14 that includes 4.1.0.14 prodkit instead of that mere version 0 stub in 4.13.0. The infamous 3.18.0 had 3.18.12 sibling with 4.0.0.12 prodkit.

I wonder where all those non-zero minor number versions are and had some of those somehow leaked?

Have you guys ever seen ANY Exx software after 3.12B.7 (which was right after 3.12.7) with NON-ZERO minor (third) number? Any of 4.XX.13 and especially 4.XX.14 versions would be EXTREMELY desirable as they contain latest versions of prodkits. 3.18.12 is the version of ubiquitous 3.18.0 but with all service functions ("Service Menu" and the rest of goodies) included.

I would've paid a substantial amount for 4.13.14 firmware had somebody had one for sale...

[ksilabs]

Btw, the interesting thing is that there were multiple software releases after 3.12.B7 that followed the same new pattern (3.12B.7 was the last one after which that started.)

Forst release was 3.13 followed by 3.14..3.18, 4.1..4.13. What Flir officially released were X.YZ.0 versions (e.g. my 3.18.0 or current 4.13.0) that ALL have one thing in common -- they ALL had version 0 prodkit that is essentially the same bare minimum with all good stuff removed. All of them, starting with 3.13.0 and all the way to current 4.13.0.

However EACH AND EVERY of those releases also had a NON-ZERO minor number version that was kinda inconsistent within 3.13..3.18 (it was .8, .9, .10, .11, 12 for 3.xx series) but then it became .13 for all releases between 4.1 and 4.6 and switched to .14 for everything up to latest 4.13. That minor version is exactly the same as the minor version of NON-ZERO version prodkits included into particular release that was 4.0.0.X for all 3.xx software versions and became 4.1.0.x starting software version 4.1. For example, the latest publicly released crippled 4.13.0 software has its FULL sibling, version 4.13.14 that includes 4.1.0.14 prodkit instead of that mere version 0 stub in 4.13.0. The infamous 3.18.0 had 3.18.12 sibling with 4.0.0.12 prodkit.

I wonder where all those non-zero minor number versions are and had some of those somehow leaked?

Have you guys ever seen ANY Exx software after 3.12B.7 (which was right after 3.12.7) with NON-ZERO minor (third) number? Any of 4.XX.13 and especially 4.XX.14 versions would be EXTREMELY desirable as they contain latest versions of prodkits. 3.18.12 is the version of ubiquitous 3.18.0 but with all service functions ("Service Menu" and the rest of goodies) included.

I would've paid a substantial amount for 4.13.14 firmware had somebody had one for sale...

BTW, methinks that's what they do at the factory -- first camera is installed with non-zero full version, calibrated and tested, then they truncate that prodkit.rev file to the bare minimum, change its revision to 0 and run something like "kitcrc -u -d" to remove the files that are no longer in kits files. I didn't try 4.13.0 but that seems to be exactly the case in 3.18.0 as their web files are NOT modified properly, they simply delete most of those so "Service" menu is STILL there from root index.asp but whatever it pointed to is deleted so there is still the service menu link but clicking it results in 404 "Page not found" error, not in some message that it is not available or whatever as it would've been the case if that web menu had been properly re-written. Prodkit also contains some torrent pieces that might indicate how their software is installed/reinstalled or changed in production.

I do also think that some of their DLLs explicitly checks the prodkit version and refuses to run anything not included there if it has 0 version. The applaunch.dat file in 4.13.0 is SIGNED with some cryptographic key to make any changes to  common_dll.dll and appcore_dll.dll impossible so one could not be able to use a hacked one. The signature clearly shows up as new applaunch.sgn file that was not present in earlier versions.

They might also have some kind of marker in their non-zero prodkit.rev file. It is nowhere to be found so it is impossible to tell if it is actually the case so it is just a wild guess.

[Bud]

The applaunch.dat file in 4.13.0 is SIGNED with some cryptographic key to make any changes to  common_dll.dll and appcore_dll.dll impossible so one could not be able to use a hacked one. The signature clearly shows up as new applaunch.sgn file that was not present in earlier versions.

That measure was defeated in E4 series time ago on this forum, might be possible for E40 too.

[ksilabs]

It is not all that important. The most important thing is getting a proper prodkit. This does not apply to E4 because it never had that service menu in the first place.

Turning on full 320x240 resolution and all "advanced" E60 features (and some more) is trivial and works even with 4.13.0.

[Bud]

I am talking about defeated signature verification. In E4 that allowed to proceed with upgrading the resolution and unlocking a bunch of features. You can use it for a different purpose. 

[ksilabs]

Of course you can. But does it matter?

BTW, T420/T440 and T6xx use very similar firmware. Filesystem layout is identical, most of the files are also identical. They DID have 3 releases with version 0 prodkit some time ago but then they dropped it and several latest releases do include the full featured non-zero version prodkit. Looks like they tried then decided it is not a very good idea and dropped that practice.

Furthermore, there is no sign of any anti-hack protection in those firmwares. The latest T6xx, v.5.17.7, still have the very short applaunch.dat that doesn't have any "DoACRC" and even no "DoCRC" lines. Everything is fully open so it might be possible to assemble some chimera update pack using Exx and T420/T440/T6xx firmware packs.

They even use that very same eFLIRInstall.exe program unchanged since 2013 for update install.

[ksilabs]

You only need to edit your configuration files. There is not much you can do other than getting full resolution, 4x zoom and a coule of other features from E60. Service menu doesn't work as of now as all X.Y.0 firmwares have the entire web server part for that menu removed and, most important, the prodapp.exe application missing. Web part is easy and some parts of it still work but the most valuable ones like calibration, dead pixel replacement etc. won't as they require prodapp.exe.

I'm still trying to get prodapp.exe from late T6xx/T440 work on E40 but no luck so far -- there are no debugging tools available, WinCE 6.0 development stuff seems to be unobtainium so it is difficult to find out why that prodapp.exe refuses to run. No error messages, no logs of any kind, just won't run.

[Devov]

I got it working.  Most of the problems I was having were due to the computer I was using, worked fine on my other workstation.

For any new-comers who want a quick summary of how to unlock settings on devices running the 04.11.0 firmware, this is what I did:

• Enable USB RNDIS Mode (Go to 'Camera Information' menu in the settings menu, hold down 'right' (->) button for 15 seconds until additional settings menu appears)
• Connect to computer, use an FTP program like WinSCP to connect to the camera. 192.168.0.2 username: flir password: 3vlig
• Back up everything
• Locate your config file \FlashFS\system\appcore.d\config.d
• For 320x240 resolution adjust this line to read as follows: .caps.config.image.settings.resIR int32 320
• Adjust this line to read as follows: .caps.config.image.targetNoise.targetNoiseMk int32 0
• For 4X digital zoom option adjust this line to read as follows: .caps.config.image.zoom.maxFactor double 4
• Feed your new config file into EzCRC01 (downloadable elsewhere in these threads)
• Zip the contents of the resulting files, change the file type to .fif
• With the camera connected to the computer run FLIRInstallNet from the FLIR Tools directory: C:\Program Files (x86)\FLIR Systems\FLIR Tools\bin\FLIRInstallNet.exe
• FLIRInstallNet should auto connect to the camera (192.168.0.2)
• Browse for the .fif file you created using EzCRC01 and click 'RunFIF'
• Once the update is completed, power down your camera, remove and reinstall the batteries.  You should now have full resolution and digital zoom capability.
• Change the USB setttings back to UVC and MSD

I printed a lens holder for a cheap ZnSe macro lens.  I need really tight resolution for a project I'm working on.  The print is ugly, but it was quick and works pretty well.  Results are attached.

Edit: I've also attached images taken at the closest possible focus setting with the FLIR 45 and 15 degree addon lenses in case anyone else is curious about their FOV.  (I got a good deal on these as FLIR was discontinuing these models)

[Fraser]

A FLIR E40bx has joined my other thermal cameras

I will be releasing it's full E60+ functionality and hopefully enabling the full E60 temperature range. It is a Mk1 facelifted model from 2011 with the metal "gull wing" side doors but separate navigation pad buttons. I need to come up with a repair for the side doors as both catch assemblies are missing. I will be contacting my friends at FLIR to establish the current availability and cost of replacement doors for the Mk1 model. If there is an option to retro fit the later rubber doors, they would be my preference.

Fraser

[Zucca]

Congratulations! Hopefully you have all the ranges calibrated, keep us posted.

[Fraser]

Hi Zucca,

My resolve to stop buying thermal cameras buckled briefly as the price and condition was too good to miss

Fraser

[Zucca]

Hi Fraser, no worries I am like you... Everything is good.
You did well, please continue to unleash the Exx devices to E60+, the world needs your service.

[peppy88]

You only need to edit your configuration files. There is not much you can do other than getting full resolution, 4x zoom and a coule of other features from E60. Service menu doesn't work as of now as all X.Y.0 firmwares have the entire web server part for that menu removed and, most important, the prodapp.exe application missing. Web part is easy and some parts of it still work but the most valuable ones like calibration, dead pixel replacement etc. won't as they require prodapp.exe.

I'm still trying to get prodapp.exe from late T6xx/T440 work on E40 but no luck so far -- there are no debugging tools available, WinCE 6.0 development stuff seems to be unobtainium so it is difficult to find out why that prodapp.exe refuses to run. No error messages, no logs of any kind, just won't run.

I own a T640. Do you need just the prodapp.exe?

[ksilabs]

Thanks for the offer but T640 prodapp.exe fails to start on Exx. I do have a full backup of T640. As a matter of fact it is still included into regular Flir firmware update package.

I'm waiting for my i.MX25 development kit shipped today from Slovakia to start hacking. I do have full WinCE 6.0R3, Platform Builder, and whatever else needed. It is going to be very deep hacking so I want a devkit to develop a procedure of un-bricking a bricked camera that I will definitely brick several times in the process. It involves building and installing U-Boot instead of default bootloader and fully re-working nk.bin making a Exx BSP/SDK in the process.

BTW, even the latest 4.13.0 still carries very old nk.bin (WinCE proper) built for i.MX27 CPU. It might be totally counter-intuitive but i.MX25 is NEWER processor built after i.MX27, mostly compatible with the latter. Freescale/NXP even has an appnote on upgrading/porting from i.MX27 to i.MX25

[caipiao]

Recently got an E50 (and have been bothering Fraser our forum expert on a few things - big shout out to him for all the help!  ).

Question to everyone: it runs 3.18.0 - should I upgrade it to 4.13.0 before I jailbreak it or not a good idea?

FOLLOW UP: forget it - jailbroken easily as per guide posted here. Question is then whether the upgrade brings anything useful?

[samboman]

A couple things.

First, someone asked a while back "BTW, saw that someone mentioned testing the 2.27.16 firmware to see if it was okay...did anyone ever give it a go?" and I didn't see any response to that. So...did anyone try it? What's the verdict?

I just got an E40 (HW E40 0.10 and FW 2.19.10) and was about to upgrade the firmware, but it tried pushing me to the 2.27.16 firmware. Since nobody has tried it, I want to upgrade to 2.23.14 instead, to be safe, but all the mirrors are dead.

Can someone please upload it again? Thanks so much!!

EDIT: I found it here: https://doc.xdevs.com/docs/Flir/Exx/fw/ and was able to install it and get everything working perfectly. I'll just avoid the newer firmware, since (most likely) nobody has tried it. Thanks

[Serpiph]

Hello to everybody again!

I find that EXX cameras with 645XXX have new version 5.2.0. I install it and then I make some test with config files. I found something interesting inside the camera. First of all the upgade program replaces my interface files with the its own ones. I compare them and then I move my corrections into the new firmware. Also I find that new firmware has a medical palette and now I can choose it for my purposes. Also the camera has the sport mode and SuperResolution mode but I don't  yet know what do they mean. My changes:
1) I remove design_ui_e2.xml and toolbar_config_e2.xml tests in appkit.rev:

Code: [Select]

FILE FlashBFS\system\ui.d\design_ui_e2.xml undefined
...
FILE FlashBFS\system\ui.d\toolbar-config_e2.xml undefined2) I edit file \FlashBFS\system\appcore.d\config.d\conf.cfg:

Code: [Select]

.caps.config.image.flow entry
.caps.config.image.flow.digitalFilter entry
.caps.config.image.flow.digitalFilter.liveNuc entry
.caps.config.image.flow.digitalFilter.liveNuc.enabled bool true
...
.caps.config.image.services.store.superResolution entry
.caps.config.image.services.store.superResolution.enabled bool true
...
.caps.config.ui.measure.sport entry
.caps.config.ui.measure.sport.enabled bool true3) I edit file \FlashBFS\system\service\appcore.d\config.d\conf.cfg:

Code: [Select]

.caps.config.image.flow entry
.caps.config.image.flow.digitalFilter entry
.caps.config.image.flow.digitalFilter.liveNuc entry
.caps.config.image.flow.digitalFilter.liveNuc.enabled bool true
...
.caps.config.image.services.store.superResolution entry
.caps.config.image.services.store.superResolution.enabled bool true4) I edit files *.xml (in attachment). Please remember that sketching mode is not working yet, I try to make it live.

What's new to my previous parameters with 4.13.0:
1) selectable frame rate for video
2) selectable video type (unfortunately csq type  is not working yet)
3) selectable image resolution (not working yet)
4) new medical palette
5) many parameters including graphs in image edit mode in preview mode
6) sketch mode in preview mode (not working, to exit you have to switch off hard your camera)
7) time lapse mode
sport mode

[Serpiph]

FOLLOW UP: forget it - jailbroken easily as per guide posted here. Question is then whether the upgrade brings anything useful?

I found blending mode in 4.13.0 and 5.2.0 for 645XXXX cameras. The cameras mixes IR and digital camera pictures together. it it similar to MSX mode but without edges enhancing.

[Nicosrap]

Dear as I can update or install new firmware.

http://subirimagen.me/uploads/20181004142641.25

[cq-317]

I just got an E30BX with 490XXXXX, I want to liberate it, I upgraded the firmware to 2.23.14 according to the tutorial. But after I upgraded the firmware I found a problem with my visible light camera. I can't store visible photos normally .
1. I used a 2GB TF card (class 4) and the file system is FAT32.
2. When I unplug the battery and then cold start, the camera can store about 6 pictures normally. After that ,Only the upper part of the stored photos is normal, and the lower part is still the last normal photo. It looks like it is stitched.
3.Only the visible photos is wrong,the IR photo doesn't has the same problem

I made some attempts
1. I continued to liberate it and I got most of the features, included Bluetooth and WiFi, photo storage is still not normal. The only difference is that the resolution of the photo before liberation is 1664*1228, and the resolution of the photo after liberation is 2048*1536.
2. I can shoot the video normally and store it in the TF card. So I think the TF card is not wrong.
3. I used a higher speed TF card, but the problem remains.
4, I used a U disk for storage, but the problem remains.

Does anyone encountered such a problem? Can someone help me?Thanks!

[cuda12]

On the touch screen in the upper right corner is there a ? mark, if there is push it then choose ok to sync the stored data. In a similar problem when all options are enabled on my e30 if at the same time I take a photo right when the camera was doing it's shutter reset thing it is like the processor is over loaded and only the top half of the picture is saved but it warns me that it was not saved. I have learned to slow down with my movements and pull the trigger slowly and solid like and it does not happen.

[cq-317]

On the touch screen in the upper right corner is there a ? mark, if there is push it then choose ok to sync the stored data. In a similar problem when all options are enabled on my e30 if at the same time I take a photo right when the camera was doing it's shutter reset thing it is like the processor is over loaded and only the top half of the picture is saved but it warns me that it was not saved. I have learned to slow down with my movements and pull the trigger slowly and solid like and it does not happen.

Yes, I choosed the button to save the data synchronously. When the camera is cold-started, a few pictures can be taken normally, then all of the pictures have only the upper part. But storing video is normal, which is really confusing.

[t.AM]

Flir E40
When updating the firmware, the battery is low.
Now the camera does not start.
In FLIR Tools not visible, but can see a USB flash drive on computer.
 
How can I fix the camera?