Author Topic: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax  (Read 5598 times)

0 Members and 1 Guest are viewing this topic.

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
UPDATE: The hack has been released! For more information, downloads, and full tutorial, go to https://spirit.re/projects/flir_hack.php
This hack works for all Ex, Exx, and Txxx cameras.

Video tutorial(referencing the page):






Original post:

I recently managed to acquire a used FLIR T440bx for a good price, but when it came to me I was slightly surprised.
FLIR advertise this model as having support for UltraMax - their proprietary super-resolution algorithm.

When I looked at the manual for enabling and using this feature, the steps detailed within it did not match my unit at all - the menus were missing, the structure was completely different.
Now, knowing that the camera is an early unit, from 2012(serial number 62100xxx, part number 62101-0701), I sort of expected having to update the firmware, and so I connected it to my PC, installed the drivers, and sure enough, when I checked in FLIR Tools+, it said that I needed a new firmware for the unit.
However, when I clicked update, not only did it not start a remote update process(which is expected with the Txxx series units), it gave me a prompt saying that my firmware version is 1.4.1(which doesn't exist!). I thought, alright, maybe it's just a bug.
But then when I tried to updating to the version it linked me to - 1.38.21, via the "eFLIRInstall.exe" and "E3Comb_v.1.38.23.fif" files placed on the SD card, the camera crashed halfway through the update with "E11 Bad Checksum on Transferred OS", and only managed to start(in the old firmware) after I pulled the battery out.

Before doing this, I did grab a full dump of the file system via RNDIS - looks like the firmware is one of the earliest versions, with the "conf.cfg" file in plain text(see below).

Code: [Select]
#
# appcore_config
#
# Generated at 2012-03-27 17:54:04
#
.caps entry
.caps.config entry
.caps.config.name text "app T440bx"
.caps.config.revision text "1.0"
.caps.config.direction entry
.caps.config.direction.sensorAccel entry
.caps.config.direction.sensorAccel.enabled bool true
.caps.config.direction.compass entry
.caps.config.direction.compass.enabled bool true
.caps.config.image entry
.caps.config.image.framegrab entry
.caps.config.image.framegrab.fusion entry
.caps.config.image.framegrab.fusion.enabled bool true
.caps.config.image.framegrab.fusion.pip entry
.caps.config.image.framegrab.fusion.pip.enabled bool true
.caps.config.image.framegrab.fusion.hcf entry
.caps.config.image.framegrab.fusion.hcf.enabled bool true
.caps.config.image.sensor entry
.caps.config.image.sensor.enabled bool true
.caps.config.image.services entry
.caps.config.image.services.store entry
.caps.config.image.services.store.enabled bool true
.caps.config.image.services.store.radiometric entry
.caps.config.image.services.store.radiometric.enabled bool true
.caps.config.image.services.store.incompatible entry
.caps.config.image.services.store.incompatible.enabled bool false
.caps.config.image.services.store.incompatible.level int32 0
.caps.config.image.settings entry
.caps.config.image.settings.enabled bool true
.caps.config.image.settings.downsample bool false
.caps.config.image.settings.resIR int32 320
.caps.config.image.sysimg entry
.caps.config.image.sysimg.alarms entry
.caps.config.image.sysimg.alarms.enabled bool true
.caps.config.image.sysimg.alarms.measfunc entry
.caps.config.image.sysimg.alarms.measfunc.enabled bool true
.caps.config.image.sysimg.alarms.measfunc.maxCount int32 4
.caps.config.image.sysimg.alarms.humidity entry
.caps.config.image.sysimg.alarms.humidity.enabled bool true
.caps.config.image.sysimg.alarms.humidity.maxCount int32 1
.caps.config.image.sysimg.alarms.insulation entry
.caps.config.image.sysimg.alarms.insulation.enabled bool true
.caps.config.image.sysimg.alarms.insulation.maxCount int32 1
.caps.config.image.sysimg.irMarkers entry
.caps.config.image.sysimg.irMarkers.enabled bool false
.caps.config.image.sysimg.irMarkers.spot entry
.caps.config.image.sysimg.irMarkers.spot.enabled bool false
.caps.config.image.sysimg.irMarkers.spot.maxCount int32 0
.caps.config.image.sysimg.irMarkers.arrow entry
.caps.config.image.sysimg.irMarkers.arrow.enabled bool true
.caps.config.image.sysimg.irMarkers.arrow.maxCount int32 4
.caps.config.image.sysimg.irMarkers.box entry
.caps.config.image.sysimg.irMarkers.box.enabled bool false
.caps.config.image.sysimg.irMarkers.box.maxCount int32 0
.caps.config.image.sysimg.measureFuncs entry
.caps.config.image.sysimg.measureFuncs.enabled bool true
.caps.config.image.sysimg.measureFuncs.diff entry
.caps.config.image.sysimg.measureFuncs.diff.enabled bool true
.caps.config.image.sysimg.measureFuncs.diff.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.diff.calcMask int32 65526
.caps.config.image.sysimg.measureFuncs.isotherm entry
.caps.config.image.sysimg.measureFuncs.isotherm.enabled bool true
.caps.config.image.sysimg.measureFuncs.isotherm.calcMask int32 20
.caps.config.image.sysimg.measureFuncs.isotherm.dual bool false
.caps.config.image.sysimg.measureFuncs.isotherm.fixScale bool false
.caps.config.image.sysimg.measureFuncs.isotherm.interval bool true
.caps.config.image.sysimg.measureFuncs.isotherm.invInterval bool false
.caps.config.image.sysimg.measureFuncs.isotherm.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.mbox entry
.caps.config.image.sysimg.measureFuncs.mbox.enabled bool true
.caps.config.image.sysimg.measureFuncs.mbox.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mbox.maxCount int32 5
.caps.config.image.sysimg.measureFuncs.mcircle entry
.caps.config.image.sysimg.measureFuncs.mcircle.enabled bool false
.caps.config.image.sysimg.measureFuncs.mcircle.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mcircle.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.mline entry
.caps.config.image.sysimg.measureFuncs.mline.enabled bool true
.caps.config.image.sysimg.measureFuncs.mline.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mline.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.reftemp entry
.caps.config.image.sysimg.measureFuncs.reftemp.enabled bool true
.caps.config.image.sysimg.measureFuncs.reftemp.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.reftemp.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.script entry
.caps.config.image.sysimg.measureFuncs.script.enabled false
.caps.config.image.sysimg.measureFuncs.script.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.spot entry
.caps.config.image.sysimg.measureFuncs.spot.enabled bool true
.caps.config.image.sysimg.measureFuncs.spot.calcMask int32 514
.caps.config.image.sysimg.measureFuncs.spot.maxCount int32 5
.caps.config.image.sysimg.visualMarkers entry
.caps.config.image.sysimg.visualMarkers.enabled bool false
.caps.config.image.sysimg.visualMarkers.spot entry
.caps.config.image.sysimg.visualMarkers.spot.enabled bool false
.caps.config.image.sysimg.visualMarkers.spot.maxCount int32 0
.caps.config.image.sysimg.visualMarkers.arrow entry
.caps.config.image.sysimg.visualMarkers.arrow.enabled bool false
.caps.config.image.sysimg.visualMarkers.arrow.maxCount int32 0
.caps.config.image.sysimg.visualMarkers.box entry
.caps.config.image.sysimg.visualMarkers.box.enabled bool false
.caps.config.image.sysimg.visualMarkers.box.maxCount int32 0
.caps.config.image.sysimg.gps entry
.caps.config.image.sysimg.gps.enabled bool false
.caps.config.image.targetNoise entry
.caps.config.image.targetNoise.enabled bool false
.caps.config.image.targetNoise.targetNoiseMk int32 0
.caps.config.image.zoom entry
.caps.config.image.zoom.enabled bool true
.caps.config.image.zoom.maxFactor double 8
# ID 62100eev
# CRC01 33vb10ge

For once the noise generator is not enabled...

There doesn't appear to be much to hack in terms of features, but UltraMax is definitely interesting - 4x the effective resolution on >9Hz cameras, for free, based only in camera firmware.

Here is the official FLIR link for the 1.38.21 firmware:
http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_t420-t440_pn62101_02_v1.38.23_update_pack.zip

Does anybody have any ideas on what is going on here?
« Last Edit: June 18, 2018, 04:29:38 pm by Spirit532 »
 

Offline Chanc3

  • Frequent Contributor
  • **
  • Posts: 394
  • Country: gb
Alas the older models (pre 2014) don't have the actual physical hardware to support the UltraMax feature (nor MSX).

Not sure what is going on with your firmware however... That is a mystery!
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
Alas the older models (pre 2014) don't have the actual physical hardware to support the UltraMax feature (nor MSX).

My T440bx supports all three - isotherms, picture in picture, and MSX, so I'm assuming UltraMax is possible too.
My model is also listed as supporting UltraMax - but this firmware version is a mystery.
« Last Edit: February 03, 2018, 09:51:57 am by Spirit532 »
 

Offline Chanc3

  • Frequent Contributor
  • **
  • Posts: 394
  • Country: gb
Alas the older models (pre 2014) don't have the actual physical hardware to support the UltraMax feature (nor MSX).

My T440bx supports all three - isotherms, picture in picture, and MSX, so I'm assuming UltraMax is possible too.
My model is also listed as supported - but this firmware version is a mystery.
Interesting! It wasn't really until 2014 that MSX was released. Have you looked at the gui.cfg file?
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
Have you looked at the gui.cfg file?

There is no such file in my dump.

However, there is .system/ui.d/config.d/conf.cfg, and that file contains an interesting line:
Code: [Select]
.caps.config.save.fastShoot bool false
Could this be the UltraMax feature?
 

Offline Chanc3

  • Frequent Contributor
  • **
  • Posts: 394
  • Country: gb
I've seen that on our T620, but alas it doesn't seem to do anything!
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
I've seen that on our T620, but alas it doesn't seem to do anything!

Can confirm, just checked. Neither "fastshoot" nor "panorama" do anything, they're the only two disabled options in ui/conf.cfg
The CRC01 process works, plain and simple. No need to touch the dlls.

Going to touch a few other files now, to see if something changes.
 

Offline Fraser

  • Super Contributor
  • ***
  • Posts: 7654
  • Country: gb
In situations like this I would normally contact FLIR support requesting clarification on the firmware version that I have, and can upgrade to. You may have a problem on this front due to your location however.

FLIR do not list their previous firmware versions so it does not mean much if you cannot find it mentioned anywhere.

It is definitely not a good idea to load an incorrect firmware version in the hope that it will work. That path can lead to much sorrow if the camera is not smart enough to abort the operation before it is completed. This is especially so with your camera having an 'unusual' firmware version that is not available as a download. You have tried the 'official' firmware version for your camera part number so it really is a case of stick with what you have, or contact FLIR for help getting the correct firmware. The downloaded firmware could even be corrupt on their servers.

You may also wish to investigate the cameras Service Menu for the option to enable the higher temperature range.

Fraser

« Last Edit: February 03, 2018, 10:38:28 am by Fraser »
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
In situations like this I would normally contact FLIR support requesting clarification on the firmware version that I have, and can upgrade to. You may have a problem on this front due to your location however.
Already done. I doubt they'll help anyway, but I did open up a ticket and register my camera.

FLIR do not list their previous firmware versions so it does not mean much if you cannot find it mentioned anywhere.
There is a leaky XML file on their site(that opens automatically when you click "update") that lists all the versions if you look around. Mine is definitely not listed there >_>

You may also wish to investigate the cameras Service Menu for the option to enable the higher temperature range.
The "bx" has the range enabled and calibrated by default :)



As for the hack - this version of the firmware is completely insecure.
Short guide for software version 1.4.1 only(untested on others):

1) Back up the filesystem(configs especially) via RNDIS.
2) Edit the .cfg however you want, enabling all features still works. Be sure to increase the max counts too :)
3) Remove the line containing "# CRC01" from the file, so that the line containing "# ID" is followed by a newline.
4) Run "crc01.exe conf.cfg", copy the "# CRC01" line it gives you back into the file after "# ID". Make sure there's a newline after it.
5) Reupload the file back to the camera. Make sure to overwrite.
6) Power the camera off, then pull the battery out(important).
7) Put the battery back in, turn it on, enjoy the hack.



Now we need more insight into the firmware updates - this version barely has any hackable features(the most useful is a measurement circle, lol).
GPS is not available despite what the config says, or so it appears - I see no info related to it in the UI, but I'll dig further.
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
Another oddity.
The web service menu is there, but entirely protected by a password(not blank), and it is not "IRCAM", "3vlig", or "1235". These guesses were under the user "flir", which seems to be universal across their entire portfolio.
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
Here's an addition for the hack:
Since the preview JPEG quality is so low(usually 85%), I made a user preset to increase it to 100%


To do this I'm using an unlisted preset - "$preset_estimate_max_load", which is not present in the files.
Inside that I created a "user.rsc" with the following code:
Code: [Select]
#
# Generated at 2011-01-26 11:13:54
#
.image entry
.image.services entry
.image.services.store entry
.image.services.store.quality int32 100
# CRC01 12ad0621


Should be pretty self-explanatory.
Attached is a file for lazy hacking - just extract the contents of the folder into /system/ on your camera(it should ask to overwrite 1 file), cold reboot(by removing battery).

If done correctly, and your camera is set to English, you should see this in your preset menu:


It has to be run every time you change modes.
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
Alas the older models (pre 2014) don't have the actual physical hardware to support the UltraMax feature (nor MSX).

Just received a reply from FLIR - my T440bx is an older 62101-0701, which does not support UltraMax.
The 62103-xxxx and 62104-xxxx support UltraMax, and it's a five hundred dollar option to purchase.

They still have no idea on the software version though, waiting for more info.

I guess the original topic of this thread is going to change a little - DIY UltraMax!
I have an idea on to do this on any 30/60Hz capable camera, will update soon if it works out.
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
Update soon, as promised!  ;D

A custom hack menu is likely possible.(see edit)

Managed to build a full WinCE application including the full SDK. Lots of possibilities from here on out.
Still working out the application window focus kinks. Right now moving or interacting with the menu immediately brings it to the foreground where it's impossible to manipulate.



EDIT: A custom menu hack is possible, including keyboard hooks, windows, and UI elements.
I don't see a reason as to why this isn't reproducible on the Ex(!!!) and Exx series cameras as well.
More info as soon as I get it to be stable in the foreground.
« Last Edit: February 07, 2018, 04:19:26 pm by Spirit532 »
 

Offline David C

  • Contributor
  • Posts: 45
  • Country: ca
Just to make sure I'm following, you're looking into a possible user "add-on" for the Ultramax feature that could work for both Ex and Exx series ? Meaning an E8+ could possibly feature the Ultramax 4x resolution upscaling in a near future ?
 

Online Bud

  • Super Contributor
  • ***
  • Posts: 2772
  • Country: ca
I remember seeing somewhere that superresolution end image is not produced on the camera, all the camera does is captures a stack of images, the combined image is then generated by Flir software outside of the camera. Can't remember where i saw it and for what camera model.
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
Just to make sure I'm following, you're looking into a possible user "add-on" for the Ultramax feature that could work for both Ex and Exx series ? Meaning an E8+ could possibly feature the Ultramax 4x resolution upscaling in a near future ?

Correct.
Also, as seen in the previous post, a huge variety of different hacks become possible once a stable, non-glitchy custom window is available(right now I'm battling with uicore.exe stealing app focus away).

I remember seeing somewhere that superresolution end image is not produced on the camera, all the camera does is captures a stack of images, the combined image is then generated by Flir software outside of the camera. Can't remember where i saw it and for what camera model.

Correct.
An UltraMax image is a standard FLIR radiometric image that has 16 lossless JPEGs(JPEG-LS) images embedded in it as a sequence, in addition to one standard 16-bit radiometric raw.
I've managed to separate them out, but I have not yet figured out a way to construct an UltraMax image due to the JPEG-LS filesize being non-constant(so a simple binary replacement won't work).
 

Offline David C

  • Contributor
  • Posts: 45
  • Country: ca
Back from my college days in graphic design, we had a third-party Photoshop plugin called Fractal made by OnOne. Fractal is an upsizing algorithm that creates new pixels to bridge the gaps and back in 2010 it was pretty amazing how good it worked, even with small resolution files. Good enough to the point where you could turn a web image into a printable one. I figured such algorithm was used for the Ultramax and other similar upscaling of thermal imager ? However you mention that in addition of upscaling a single jpeg, it overlays 16 other jpeg to fill in the radio metric data of the created pixels ?
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
UltraMax(and Testo's SuperResolution, same thing basically) rely on the tiny hand movements between frames to basically put the sensor pixels themselves "between" the gaps - effectively increasing the pixel density.
The idea is to not only get a higher resolution, "fake" upscaled image - but actual sub-pixel radiometric values.

It's a mix of supersampling and deconvolution, just lots math.
 

Offline David C

  • Contributor
  • Posts: 45
  • Country: ca
You said it could work on 30hz and above imagers, but what about the 9hz Ex series ? Perhaps the results would be less dense ?
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
The goal is the same - to capture 16 slightly different images.
I'm assuming you'll just have to have very steady hands for ~2 seconds :)
 

Offline David C

  • Contributor
  • Posts: 45
  • Country: ca
That works for me. I'm guessing it's not gonna be effective on moving objects and targets with temp variations above 9hz ?
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
Definitely not. This is very much a "still image" thing, even on 30/60Hz devices.
 

Offline David C

  • Contributor
  • Posts: 45
  • Country: ca
I'd be interested in doing some amateur photography with my E8+, so 4x upscaling would serve the purpose nicely, despite the low end output of the Ex imager. Let me know if you need some funding in your research !
 

Offline Spirit532

  • Frequent Contributor
  • **
  • Posts: 285
  • Country: by
I might need help with testing on other hardware(namely the Ex and Ex0), but I am far from done right now.
I've got the keyboard hook working though, all of the controls register as separate buttons! :)
Still fighting the GUI.
 

Offline David C

  • Contributor
  • Posts: 45
  • Country: ca
I am not wizz enough in the coding department, however I can navigate my way trough file logs and html type of stuff, as well as poke around folders if I know I'm not gonna mess anything up on the camera itself. I think Bud with his E4+ wifi will be the man to do the Ex testing, but feel free to ask what you need and I'll do what I can to make it happen.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf