FLIR E75 Upgrade to E95

[DaveWB]

Currently have an E75 on loan, man is it sweet compared to an upgraded E4, using this was my first time hearing about/using the UltraMax feature. Only downside to the camera is it's 7x the price of the E4.(Unless the E53 can be upgraded to E95, which is around $5k),

I was able to get the camera to get to RNDIS mode via the hidden menu and it shows up as 192.168.0.1 under ipconfig /all(screenshot attached), however when trying to FTP into the camera with FileZilla it says

Code: [Select]

Status: Connecting to 192.168.0.1:21...
Status: Connection attempt failed with "ECONNREFUSED - Connection refused by server".
Error: Could not connect to server
I tried both connecting anonymously and flir:3vlig and received the same error for both.

I would like to upload a backup of the camera to see if there is a remote possibility of these cameras being upgraded before I have to give it back.

[Chanc3]

I had the same problem when connecting to the T1030sc I had on demo. Perhaps try admin|admin admin|password or even root. Not that familiar with Linux, but try the default ones for that.

[Spirit532]

The Ex5 and the E53 cameras run a brand new, in-house, completely unknown(to us) Linux firmware, rather than using the WinCE firmware that has roots in AGEMA, which was acquired by FLIR(the PM and P-series cameras).
It would likely require a direct flash dump(or internal serial) to get the new FTP server passwords, sadly. And even then, it's a completely different OS with(likely) better security, since the entire Ex5 lineup and the E53 have a full-sized 640x480 30Hz detector inside them.

[railrun]

Hi Dave,

192.168.0.1 is your PC. You have to try 192.168.0.2

Currently have an E75 on loan, man is it sweet compared to an upgraded E4, using this was my first time hearing about/using the UltraMax feature. Only downside to the camera is it's 7x the price of the E4.(Unless the E53 can be upgraded to E95, which is around $5k),

I was able to get the camera to get to RNDIS mode via the hidden menu and it shows up as 192.168.0.1 under ipconfig /all(screenshot attached), however when trying to FTP into the camera with FileZilla it says

Code: [Select]

Status: Connecting to 192.168.0.1:21...
Status: Connection attempt failed with "ECONNREFUSED - Connection refused by server".
Error: Could not connect to server
I tried both connecting anonymously and flir:3vlig and received the same error for both.

I would like to upload a backup of the camera to see if there is a remote possibility of these cameras being upgraded before I have to give it back.

[Fraser]

Spirit523,

A very interesting comment from you here. I thought the PM series cameras ran Linux but it was only a suspicion. I thought the WinCE usage came from the FLIR purchase of Extech and Indigo ?

Have you had any experience accessing the operating system on a PM or P series camera please.

I ask because I am interested n delving inside both a PM and P series cameras OS.

Fraser

[Spirit532]

Spirit523,

A very interesting comment from you here. I thought the PM series cameras ran Linux but it was only a suspicion. I thought the WinCE usage came from the FLIR purchase of Extech and Indigo ?

Have you had any experience accessing the operating system on a PM or P series camera please.

I ask because I am interested n delving inside both a PM and P series cameras OS.

Fraser

The PM cameras are visibly screaming "I AM RUNNING NATIVE WINDOWS CE UI" when you run it, I don't know how you can miss it.
You'll find that it's extremely similar to the new Ex series.

[Fraser]

I am a specialist hardware tech, not a coder and definitely not knowledgeable on WinCE 😄

[Fraser]

Likely showing my ignorance here, but I always thought Win CE was an X86 / ARM OS

The PM series cameras are MC68K based devices. The MC68340 to be precise. I shall have to investigate the firmware further in light of your comments.

Thanks

Fraser

[Fraser]

Wow I see WinCE was only released in late 1996 and the PM570 was a 1997 release as I tested the first one in the UK. That means the PM570 would be running WinCE 1.0 aka Pegasus. The very first release. AGEMA were pretty brave to base their latest ground breaking camera on one of Microsofts very early software releases 

Sorry, I have dragged this thread off topic. It was just that Spirits's comment grabbed my attention.

Fraser

[DaveWB]

Whoops, my bad. I did try both 192.168.0.1 and 192.168.0.2 to connect to the camera using a bunch of combinations including admin/admin, root/ , root/toor, admin/password, etc... no go.

[Spirit532]

Likely showing my ignorance here, but I always thought Win CE was an X86 / ARM OS

The PM series cameras are MC68K based devices. The MC68340 to be precise.

Correct, that means my knowledge is wrong.
The UI definitely does look like CE though.

[Pinkus]

I am sure Flir's product manager of the Exx line almost got a heart attack  when he first read the subject/topic in the thread list. You better add a question mark behind for their easement

[railrun]

I am sure Flir's product manager of the Exx line almost got a heart attack  when he first read the subject/topic in the thread list. You better add a question mark behind for their easement

[BOGET]

I don't have enough $ to burden a new Exx for test anymore,

The price is too high for me, but I still want to see someone who can hack Linux-based systems.

@Dave

you should try to login first using by a brute-force attack tool, (e.g. Hydra)

Specified the username and use dictionary to find the password out.

like:

Code: [Select]

# hydra -t 1 -l flir -P /your/password_dictionary's/path/password.txt -vV 192.168.as.yours ftp
Here has some tutorial :

[tomas123]

Whoops, my bad. I did try both 192.168.0.1 and 192.168.0.2 to connect to the camera using a bunch of combinations including admin/admin, root/ , root/toor, admin/password, etc... no go.

really doesn't work the good old login?
user: flir
pass: 3vlig

there is a simple hack to get the password:
Connect the camera with the IOS/Android app and get the ftp password by record the wifi traffic (wireshark)

[railrun]

I tried both connecting anonymously and flir:3vlig and received the same error for both.

@tomas123: Maybe they changed the login, and/or password and/or use a other port...

[tomas123]

as I described above, I got the FTP password for my Exx some years ago with wireshark.
it's easy

[BOGET]

@tomas

I read lots of your post before,

that was really awesome and very professionally,

I think you're the one who can easily hack into new linux-based systems.

[DaveWB]

Sorry, haven't been watching this lately. Was just about to return the camera but will try both BOGET's and tomas123's suggestions

[DaveWB]

I am not finding an iphone or android app for wireshark, are there special instructions to get it to work?

[tomas123]

wireshark is a PC Software.
https://en.m.wikipedia.org/wiki/Wireshark

there are  some variants to record the wifi traffic:
a) catch traffic with a wifi router e.g. fritz.box in germany :-)
b) use a notebook with a lan and wlan port as man in the middle (or two wlan ports as wifi subnet)

google this topic, it's easy
the ftp password is uncrypted plain text

[DaveWB]

wireshark is a PC Software.
https://en.m.wikipedia.org/wiki/Wireshark

there are  some variants to record the wifi traffic:
a) catch traffic with a wifi router e.g. fritz.box in germany :-)
b) use a notebook with a lan and wlan port as man in the middle (or two wlan ports as wifi subnet)

google this topic, it's easy
the ftp password is uncrypted plain text

I created a wifi network on the camera, and connected to it from my PC. unfortauntely I was unable to find a plain text ftp username and password

[tomas123]

great
Do you have recorded the traffic between the flir tools app and your Exx camera (load an image)?
see this sample for decoding the stream:
http://www.freekb.net/Article?id=133
https://blog.packet-foo.com/2016/07/how-to-use-wireshark-to-steal-passwords/comment-page-1/

[DaveWB]

great
Do you have recorded the traffic between the flir tools app and your Exx camera (load an image)?
see this sample for decoding the stream:
http://www.freekb.net/Article?id=133
https://blog.packet-foo.com/2016/07/how-to-use-wireshark-to-steal-passwords/comment-page-1/

I attempted following this however I was unable to see any ftp data within Wireshark. I have a Ubiquiti Accesspoint in which this is connected to, I connected my computer to the secondary port of this access poin. The camera was connected to the access point and I could see the camera connection within Wireshark but when I went on my phone and imported images over wifi, nothing showed up. The only protocol the FLIR seems to be triggering within Wireshark seems to be TCP and MDNS.

[tomas123]

Hi DaveWB,

I looked in my old notes from June 2013.
With Flir Tools for IOS, my E40, WiFi and Wireshark I got this FTP protocol snippet after taking an "instant picture" with the Flir tools app :

USER anonymous / PASS cfnetwork@apple.com 

Code: [Select]

WireShark FTP

220 Service ready for new user.
USER anonymous
331 Anonymous access allowed, send identity (e-mail name) as password.
PASS cfnetwork@apple.com
230 User logged in, proceed.
SYST
215 Windows_CE version 6.0.
PWD
257 "/".
TYPE I
200 Command okay.
CWD /Temp/
250 Requested file action okay, completed.
PASV
227 Entering Passive Mode (192,168,16,70,192,22).
RETR irviewerimg.jpg
125 Data connection already open; transfer starting.
226 Closing data connection.
With this steps, Flir Tools loaded the last image irviewerimg.jpg from my E40.

here is the wireshark TCP snippet, which shows how the Exx get the single Telnet commands from the app to take an image
user: root / pw: 3vlig

WireShark TCP

.......................................................5..
root.3vlig.................).........5G..
image.services.store.overlay........H.......<.........5.........5..........
image.services.store.overlay...................'.........5G..
image.services.store.irCut........H.......:.........5.........5..........
image.services.store.irCut...................+.........5G..
image.services.store.overwrite........H.......>.........5... .....5..........
image.services.store.overwrite...................+.........5G..
image.services.store.filenameW........H.......7.........5...........
image.services.store.filenameW.....................-.........5G!.
image.services.store.stage.start........H.......9.........5.........!.
image.services.store.stage.start.....................*.........5G..
image.services.store.bgActive........H.......+.........5..
image.services.store.bgActive.........6..)....B...........................................F........&.........5G..
image.services.store.busy........H.......2.........5...........
image.services.store.busy..................... .........5G..
image.state.channel........H.......!.........5..
image.state.channel.........8..)....B..........................................IR..........(.........5G..
image.services.store.format........H.......?.........5.........5..........
image.services.store.format.JPEG..................*.........5G..
image.services.store.filename........H.......R.........5.........5..........
image.services.store.filename./Temp/irviewerimg.jpg..................(.........5G..
image.services.store.commit........H.......;.........5.........5..........
image.services.store.commit...................,.........5G .
image.services.store.bgStoreNow........H.......?.........5...!.....5..........
image.services.store.bgStoreNow............

maybe this helps...

Additional information that i have not seen yet in this thread:

When camera is in RNDIS permanent mode, you can FTP to it even if it is turned off but is connected to USB. However the login  is not flir/3vlig. The login credentials in this case are:

user:   anonymous
psw:    NcFTP@

[Abvelv]

Code: [Select]

Status: Connecting to 192.168.0.1:21...
Status: Connection attempt failed with "ECONNREFUSED - Connection refused by server".
Error: Could not connect to server

Connection refused isn't a credential issue, it means that there is no service listening on tcp/21. As someone else pointed out this may be the address of your local machine. Once you are sure you are connecting to the right IP (such as .2) use a port scanning tool such as nmap to see what's open on the system. It might be using ssh or something else, regardless of what OS it's running under the hood.

[Chanc3]

I've got a T1020 at our office, which runs the same OS as the Ex5 series. I'll check port numbers etc when I get a chance and can see if that info helps.

[DaveWB]

I attempted these combos and unfortunately none of them worked but I think it is tied to something else: when I connect the cam via USB while its in RNDIS mode via hidden menu, the blue box in the bottom right of my screen will pop up saying Thermacam IP 192.168.0.2 then about 15 seconds later is will say connected after it had already said it was connected.

[agiorgitis]

any news on this topic?

[Spirit532]

It'd help to have a complete flash dump, but I doubt anyone would donate a fresh Ex5 camera for a warranty-destroying teardown

[agiorgitis]

Hi guys,

As an update to this topic, is anyone interested on trying to decrypt conf.cfc from an E75? Like on E4.
cfccfg.py and cfccfg_v2.py methods do not work.

I can help you with any camera files needed for this research.

 

[agiorgitis]

I wonder why no one is interested on adding custom functions, or porting E95 functions to E75, or trying to liberate E75/85 to match E95. 
Is this due to hacking abilities? Or just lack of interest or no hands-on access to those models? 

[Fraser]

I think there is a very simple explanation...... the cost of an E75.

At around £7K in the UK, the E75 is anything but budget priced ! People who buy such expensive thermal cameras are less likely to want to mess with them.

The E4 was an amazing opportunity as it was a ‘budget’ priced thermal camera that could be upgraded to the far more expensive model. The risk of wrecking an sub £1K E4 during the research into the cameras firmware was far less scary than bricking a £7K+ camera. Just watch Mike tear into his new E4 to investigate its design to see what I mean !

The Ex5 series are intended for semi- professional and professional use. Such users are often businesses and less interested in hacking a camera that they rely upon to earn income. Also, using a ‘hacked’ camera can be bad for the businesses reputation.

The Ex5 series are not a simple task to upgrade as FLIR did learn from the Ex series upgrade developments. Enough people would need to want the upgrade to make it worth the potential cost and time required. I do not see that demand at the present time. Maybe when the Ex5 cameras come onto the secondary market at around the $2K mark we may see development of upgrades in the community.

Fraser

[agiorgitis]

Fair enough, I agree.

Plus the fact that even E75 produces much better images compared to an E8, so they probably don't need more resolution than that.
But what about the extra UI modifications which can be done safely? Like palletes.

I guess that I'm one of the few who has played around with the -safe to edit- files, like activating the timelapse function for example, found on E95.
 
I could try to do more, but anything more than that, like decrypting of conf files and boot sequence, are beyond my abilities...

[_Wim_]

If your lucky enough to have an Ex5, I would also snatch this one from Ebay:
https://www.ebay.co.uk/itm/FLIR-42-Wide-Angle-Lens-EXX-TXX-Series-T199590/233469566566?hash=item365bdede66:g:mf0AAOSwM2deEkW0

Seller is even open for offers! If only it would fit my E30...

[agiorgitis]

Thanks Wim!
Unfortunately I'm chasing an offer for the 14o zoom version. 

[Fraser]

Wim,

That lens previously sold for £130 from the same seller. A total bargain if it actually truly sold (look at recent ‘sales’ then look for recent feedback). Why is it up for same again ? I have my own thoughts on that sellers auctions but I will keep them to myself. As you state, it is a primary lens and not a supplementary type as used by the Ex0 series.

A ~45 Degree lens is very useful as it normally provides great close-up working capability and is perfect for viewing building exteriors. ~24 Degree HFOV can be a little narrow when wishing to view large targets. You do, of course, trade IFOV for greater HFOV.

I managed to buy the 10mm wide angle lens for my E40 the other day. It is currently on its way to me from Canada. Cost was a reasonable C$300 (US$226). They do appear on eBay now and then.

Fraser

[_Wim_]

That lens previously sold for £130 from the same seller. A total bargain if it actually truly sold (look at recent ‘sales’ then look for recent feedback). Why is it up for same again ?

Ha, that I did not notice before! Thanks for pointing out. Seems to be a trend lately, I also had 2 Ebay purchases that would have been bargains, but both sellers apparently "lost" the device and  cancelled the purchase. One of them put the same back up for auction only a few weeks later, the other one did not so far.

I managed to buy the 10mm wide angle lens for my E40 the other day. It is currently on its way to me from Canada. Cost was a reasonable C$300 (US$226). They do appear on eBay now and then.

So far I am using a ZnSe CO2 laser lens with decent results, but for 226$ I would not let it pass also. You seem to be very good in finding thermal imaging deals!

[mikhail076]

it seems someone did this upgrade:
https://www.ebay.com/itm/124699245429

[therwp]

it seems someone did this upgrade:
https://www.ebay.com/itm/124699245429

"Someone" indeed.

From the listing: "The upgrade was completed in house by Flir Systems Canada Ltd. in Burlington Ontario. The documentation for the service record is available."

Damn lol.

[agiorgitis]

How difficult is to flash the firmware from E95 into E75?

Instead of hacking E75 with a resolution update, to load the E95 one instead bypassing any hardware S/N checks.

[Spirit532]

How difficult is to flash the firmware from E95 into E75?

Instead of hacking E75 with a resolution update, to load the E95 one instead bypassing any hardware S/N checks.

Externally, likely not very possible. And if done, it would most certainly wipe all the calibration data, rendering the unit near useless, permanently.
It would require a hack. Doable, with enough reverse-engineering, but I've yet to have anyone offer to donate a newer Ex5 series device(or two, really, one non-working) for a semi-destructive teardown to dump the flash and reverse-engineer it.
I'm almost certain that it's possible to hack the lowest end Ex5 to the highest end(and beyond, as with the E8+) 640x480 Ex6 unit, and the firmware is almost certainly built on an older kernel with plenty of unpatched exploits that were never meant to be accessible(since it's not a networked IoT device).
The Ex5 and T5xx both run a similar, if not identical, platform, so this would apply to that lineup as well.

[mikhail076]

very expected.
all is by analogy with e30))
sure e53 has the same hardware as eX5.