Products > Thermal Imaging

Flir T3xx\T4xx\B3xx\B4xx un-brick + semi-hack

(1/1)

arttdat:
First of all, although not tested, but most of what is written below should theoretically apply to Flir T3xx/T4xx/B3xx/B4xx family of cameras as well.
Some of the methods probably expand even beyond that, as per my understanding, large array of Flir cameras share similarities in SW part.

Initial issue

I had a Flir T335 camera which suddenly stuck on boot, no GUI available, buttons besides power are unresponsive.
RNDIS connection worked, so upon investigation i had determined, that whole flash storage died suddenly, most probably partition corrupted along with whole FlashFS folder.
You can easily check if that is the case for your issue as well by running

--- Code: ---diskutil -L
--- End code ---
in the console. If you see , and specifically: No partitions found on "DSK1:"!, well my condolences to your GUI file system.

Fixing attempts

You could try to use update files from the Flir website, using FLIRInstallNet, or copying FlashFS manually trough FTP, but ultimately it wont give much.
As the FlashFS folder is being created after startup, it will be created in volatile storage - RAM, which means that any changes made to the file system will be lost on power-off.
Nevertheless, even if you do so, Flir update files do not contain crucial sensor specification data which the appcore requires to properly initialize. They are only designed to be update to the existing FlashFS file system.
You will have the GUI, and even the Service menu, but it will be unusable, so no calibration could be done.

Repairing procedure

1. Repartitioning
Flowing applies to those cases where you have NO FlashFS folder, or it is empty, otherwise following procedures listed below can make it worse for you. If you still suspect some partitioning issue, backup that FlashFS folder before wiping.

So first of all, check if you have the "DSK1:" at all, if you also have SD card inserted, it should read as "DSK2:"
If you don't have "DSK1:" (Intel Virtual File System), do not follow next steps, you probably have HW issues at this point, and you only will nuke your SD card.
If "DSK1:" is there, do a full low-level format:

--- Code: ---diskutil -F DSK1: -l
--- End code ---
Then make sure that you do not have the FlashFS folder, like left over from previous attempts or installs of updates.
If it's there, delete it.
Then make a new partition:

--- Code: ---diskutil -C DSK1: -p Part00 -x 88600
--- End code ---
(88600 is the partition size, if you have larger or smaller size, adjust accordingly, check "Biggest Partition Creatable (sectors)" in diskutil for DSK1)
Restart the camera by entering "restart"
Upon booting run the

--- Code: ---diskutil -L
--- End code ---
again. If above steps were successful, that newly created partition should be mounted as FlashFS, and diskutil should look something like that:
If you are here, congratulations, easy step is done :D

2. Diagnosing severity
So now that the easy part is done, we need to rebuild the file system.
This step could vary for some people, as if you have at least part of the FlashFS, you could just recalibrate it yourself and possibly have a working camera again.
Now run the update using update files from the Flir website by FLIRInstallNet, or extracting FlahsFS from update file and copying FlashFS manually trough FTP.
If you had some backups or parts of the system, copy them to FlashFS folder afterwards.
Restart the camera, check that all you files are still there, then we can continue.
Now we check on how dire is the situation, activate the service mode in Service menu, or run a command:

--- Code: ---rset prod.preparation.command restartHighRes
--- End code ---
If its nagging about bad command, or unavailability of server, run

--- Code: ---start restartapp.bat
--- End code ---
Then after everything is started, you can check for prodapp and appcore process by:

--- Code: ---ps
--- End code ---
If appcore or prodapp is not starting at all, well you have some deeper issue, check the logs in \Temp or \FlashFS\tmp\prod.log or \FlashFS\tmp\cmd.out.
If you have successfully entered service mode (check in web server or by running: "rls prod.preparation"), observe how your camera is behaving, if you have thermal image, congrats, you probably only will need to recalibrate and do other setups in the Service menu, I wont be going into that, as I'm not an expert in it.
But if you don't see any usable image, thats far more serious.
As a possibly useful side step of diagnostics, you can try to force visual stream to the display:

--- Code: ---rset image.services.channel.active VISUAL
rset image.services.channel.commit true
--- End code ---
In my case it showed a working camera (the normal one, not IR).

3. Rebuilding FlashFS
So now if you are here, that's bad news.
The only way of repairing the FlashFS is to search the internet for backup files or full system images (I assume that any T3xx/T4xx/B3xx/B4xx will do, but you can expect some manual tuning of the files and settings).
I can't be going into details, but can generally describe that process as "poke and see", by constantly consulting with the log and changing stuff.
Possibly, to be on a safe side, you will need to update EEPROM data accordingly to the backup files.
That's done in Service menu, password: 1235
Also if you see "No \FlashFS\system\prodresult.rsc found", don't worry about it, it's not required.

arttdat:
Now, during my investigation I found an array of potentially useful commands as well as hacky workarounds that one could use in various debugging or configuration situations.

►prodapp commands:
(use by setting command variable for example: "rset prod.calib.command init")

  prod.calib.command

* nop
* init
* setCase
* setLensCase
* setCaseEx
* setLensCaseEx
* measure
* calcRBF
* calcRBFZ
* aim
* initProto
* protMeasure
* saveProto
* logResults
* focusFar
* focusSave
* focusRestore
* aimz
* checkBB
  prod.map.command

* nop
* init
* setCaseEx
* setLensCaseEx
* gainMap
* gainDeadMap
* autoGainMap
* autoBgMap
* killSpatImg
* killSpatGain
* killTempoImg
* killTempoLong
* killSlow
* killDyn
* killAllGain
* killAllGainE
* killPix
* killColumn
* killRow
* autoColumn
* autoRow
* checkMap
* checkMapNoSpec
* specPixKill
* logResults
* logDosResults
* saveGainMap
* saveDeadMap
* measColdImage
* measWarmImage
* makeMapInfo
* measColdImageMp
* measWarmImageMp
* saveCrsMap
* nuc
* deleteMaps
* killUnLin
* replaceKilled
* saveCalib
  prod.measure.command

* nop
* init
* averageImage
* calcResponse
* startGrab
* stopGrab
  prod.netd.command

* nop
* init
* spatial
* temporal
* total
* fileSpatial
* fileTemporal
* fileTotal
* tempoFilter
* bilateralFilter
* edgeFilter
* setNoise
* specOperation
* logResults
* logDosResults
* spatFilter
* columnFilter
* setSpan
  prod.onchip.command

* nop
* init
* collect
* select
* coarseMap
* simpleMap
* logResults
* findRM
* findOA
* responseCold
* responseWarm
* calcIntTime
* calcDuWm2
* findKOA
* findOffset
* calcRmT
* responseColdZ
  prod.preparation.command

* nop
* init
* setDateTime
* stopgui
* powerOff
* prodResults
* saveProdState
* checkProdState
* setTorrentErr
* clearUploaded
* restartHighRes
* restartReconfig
* checkPowerDown
* eval
  prod.syscalib.command

* nop
* init
* selCases
* addLensCases
* measure
* clearAllSel
* addOneBB
* delOneBB
* retrRBFcond
* calcRBF
* getVersions
* actiSave
* save
* discard
* switch
* accInit
* accSel
* accMeas
* accSave
* aim
* aimDone
* alignFar
* alignNear
* alignStore
* alignInit
* fusion
* laserInit
* laserFar
* laserNear
* laserStore
* focus
* focusFar
* focusNear
* focusStore
* focusDist
* focusAuto
* logAlignResults
* setLensDist
  prod.tdrift.command

* nop
* init
* start
* stop
* storeImage
* refLogLine
* nuc
* nearReference
* reference
* makeBGMaps
* storeRawImage
* dosCollectImage
* logResults
* firstRef
* nextRef
* firstShutterMap
* nextShutterMap
* saveShutterMap
* shutterMapHT
  prod.ulisDos.command

* nop
* init
* tecLog
* logResults
* findVsk
* storeRawImage
* calcGainDeadMap
* calcRBF
* calcRTVBB35C
* calcDynRange
* calckVsk
* checkVsk
* updateAtpInfo
* stateCold
* stateWarm
* memTest

►Some useful launch keys:
supv [-p port] [-l] [-a] [-m <msg>] [-k] [stop|start|unload]
 -l   list libraries as well as tasks
 -a   list applications as well as tasks
 -m   send message to progress app, prefix with '#' or '!'
 -k   kill progress app

AppCore [-p <port>] [-r item] [-t] [-v]
 -p   local port (default 0x%04x)
 -r   remove [item] from startup
 -t   disable FMP, use only TCP
 -v   verbose supv (debug)

ProdApp [-n <name>] [-p <port>] [-a <addr>] [-s <port>] [-v]
 -n   local name (default %s)
 -p   local port (default 0x567B)
 -a   server addr (default 127.0.0.1)
 -s   server port (default 0x5678)
 -t   <use FMP> If -t 1, use FMP for interprocess comm. Defaults to 0
 -v   verbose supv (debug)

Especially useful might be the -v keys, as in the process of initialization they will generate more information, both in the console output and in logs.
Also you can unpack my script  restartappVerb.7z to the FlashFS or any other directory, upon running it, it will kill currently opened instances of prodapp and appcore and restart them in verbose mode.

►Service menu
While I was tinkering with the SW guts of the camera, I noticed that no matter which password I try, I couldn't get into the Service menu whatsoever.
None of the passwords that can be found on this forum or the internet seems to be working.
There could be several problems that could lead to that, and here are few interesting ways of mitigating that issue:

* Try to run "start \FlashFS\system\defaultusr.exe".
As i discovered, sometimes the "flir" user is not being set up during boot time, and you wont be able to log in.

* Use commands provided above, as they are basically the same stuff (but slightly more advanced) that is in that Service menu.

* httpd service running in Windows part of the SW only restricts entry to specific part of the web server, which is "http://_CAMERA_IP_/service/",
but if we were to make a copy of it, altering internal links, there is no restriction on a different name  ::)
Not sure how it works on a different family of Flir, you probably will need to make your own out of "service" folder in \FlashFS\system\web, but for the T/B series, you can use mine:  manuf.7z
Just unpack it in "\FlashFS\system\web" and access by the link: "http://_CAMERA_IP_/manuf/index.asp"
If there is "no connection" message, you can try to run "start sdauthutildevice.exe", and restart prodapp, because sometimes supervisor is messing up something in httpd service.

►Config dump
While you are changing stuff and trying to configure something blindly using different backup files and what not, its useful to actually compare current config of the server to the previous.
To do that you can make dumps and just compare them in the Notepad++ compare plugin, or any other app.
You can use

--- Code: ---rls -r -l -t >\StorageCard\rlsDump_T335.txt
--- End code ---
or

--- Code: ---rdump -r -o -f \StorageCard\rdumpService_T335.txt .
--- End code ---


►Windows UI access
You can access Windows UI for various reasons, but easiest way for me was to start the appcore, wait for the screen to update to the GUI, and the kill it, and start the shell and explorer.
Also if transparent sections of UI bothers you, just set background image in Windows to tiling.

--- Code: ---start restartapp.bat
start stopapp.bat
start shell
start explorer

--- End code ---
Edit:
It's worth to point out, that UI of the Windows have higher priorities on some files than the console does.
For example, you could copy httpd log by Windows UI and read it by console or download directly to PC.
Also by Windows UI Explorer you can easily uncheck hiding of system files and others, and browse ALL actual files that it contains.
As connecting by FTP usually does it in a "linux" way and viewing hidden files is not straightforward.
You could also use "dir" command with specified hidden and system attributes, but different sets of files, have different attributes, so in my opinion it's easier to just browse all of them in the Explorer.
Who knows what gems you could find there ;)

Somewhat-hack
Of course we want the full potential of our hardware, and non of the pesky "target noise" added to our picture ;)
Therefore I made a script purely for lab and testing purposes  ^-^
FIF for easy one button Service mode launch from the GUI of the camera:  FLIR_Service_activator.7z
To start it just do the "Firmware update" selecting that FIF file from the Menu -> Info -> Service information -> Firmware file

And there is also batch script for running within the console:  restartServiceMode.7z

I personally have not done it, for me current optional service mode is enough, but if someone was determined to have Service mode on-boot, to do that, he would probably use something like that:

--- Code: ---rcreate -n 99 appl.startup.add
rset appl.startup.add.99.action "START"
rset appl.startup.add.99.name "cmd.exe"
rset appl.startup.add.99.param1 "/C \FlashFS\system\restartServiceMode.bat"
rset appl.startup.add.99.type "APP"

--- End code ---
(don't quote me on that, haven't tried it, possibly need to add some delays in the script to wait for proper init of the prodapp, if someone wants to test and verify, you are welcome :D)

arttdat:

Credits:
Repairing of the broken partition
Repairing of the bricked T335

And of course, the Man, the Myth, THE LEGEND: Mr. Fraser himself :D
That man singlehandedly had outsupported whole multi-billion dollar company, as their help was: "Yeah... No. If you want your multi-thousand camera be working again, send us hundreds of dollars and may be in a month you will get it"
But that man has provided with the crucial system files that were required for primary initialization of the system, and therefore Christmas miracle had happened in May for me ;D

Fraser:
Arttdat,

Thanks for the excellent post detailing your hard work and processes to recover your camera. I am so pleased that it is now working again  :-+

Fraser

arttdat:
Fraser,
All thanks to you! :)
Please keep up the good work, You’re making a real difference!

Navigation

[0] Message Index