EEVblog Electronics Community Forum

Products => Thermal Imaging => Topic started by: Spirit532 on February 02, 2018, 10:27:55 pm

Title: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: Spirit532 on February 02, 2018, 10:27:55 pm
UPDATE: The hack has been released! For more information, downloads, and full tutorial, go to https://spirit.re/projects/flir_hack.php (https://spirit.re/projects/flir_hack.php)
This hack works for all Ex, Exx, and Txxx cameras.

Video tutorial(referencing the page):
https://www.youtube.com/watch?v=xa6AF0nW4AU (https://www.youtube.com/watch?v=xa6AF0nW4AU)





Original post:

I recently managed to acquire a used FLIR T440bx for a good price, but when it came to me I was slightly surprised.
FLIR advertise this model as having support for UltraMax - their proprietary super-resolution algorithm.

When I looked at the manual for enabling and using this feature, the steps detailed within it did not match my unit at all - the menus were missing, the structure was completely different.
Now, knowing that the camera is an early unit, from 2012(serial number 62100xxx, part number 62101-0701), I sort of expected having to update the firmware, and so I connected it to my PC, installed the drivers, and sure enough, when I checked in FLIR Tools+, it said that I needed a new firmware for the unit.
However, when I clicked update, not only did it not start a remote update process(which is expected with the Txxx series units), it gave me a prompt saying that my firmware version is 1.4.1(which doesn't exist!). I thought, alright, maybe it's just a bug.
But then when I tried to updating to the version it linked me to - 1.38.21, via the "eFLIRInstall.exe" and "E3Comb_v.1.38.23.fif" files placed on the SD card, the camera crashed halfway through the update with "E11 Bad Checksum on Transferred OS", and only managed to start(in the old firmware) after I pulled the battery out.

Before doing this, I did grab a full dump of the file system via RNDIS - looks like the firmware is one of the earliest versions, with the "conf.cfg" file in plain text(see below).

Code: [Select]
#
 # appcore_config
 #
 # Generated at 2012-03-27 17:54:04
 #
.caps entry
.caps.config entry
.caps.config.name text "app T440bx"
.caps.config.revision text "1.0"
.caps.config.direction entry
.caps.config.direction.sensorAccel entry
.caps.config.direction.sensorAccel.enabled bool true
.caps.config.direction.compass entry
.caps.config.direction.compass.enabled bool true
.caps.config.image entry
.caps.config.image.framegrab entry
.caps.config.image.framegrab.fusion entry
.caps.config.image.framegrab.fusion.enabled bool true
.caps.config.image.framegrab.fusion.pip entry
.caps.config.image.framegrab.fusion.pip.enabled bool true
.caps.config.image.framegrab.fusion.hcf entry
.caps.config.image.framegrab.fusion.hcf.enabled bool true
.caps.config.image.sensor entry
.caps.config.image.sensor.enabled bool true
.caps.config.image.services entry
.caps.config.image.services.store entry
.caps.config.image.services.store.enabled bool true
.caps.config.image.services.store.radiometric entry
.caps.config.image.services.store.radiometric.enabled bool true
.caps.config.image.services.store.incompatible entry
.caps.config.image.services.store.incompatible.enabled bool false
.caps.config.image.services.store.incompatible.level int32 0
.caps.config.image.settings entry
.caps.config.image.settings.enabled bool true
.caps.config.image.settings.downsample bool false
.caps.config.image.settings.resIR int32 320
.caps.config.image.sysimg entry
.caps.config.image.sysimg.alarms entry
.caps.config.image.sysimg.alarms.enabled bool true
.caps.config.image.sysimg.alarms.measfunc entry
.caps.config.image.sysimg.alarms.measfunc.enabled bool true
.caps.config.image.sysimg.alarms.measfunc.maxCount int32 4
.caps.config.image.sysimg.alarms.humidity entry
.caps.config.image.sysimg.alarms.humidity.enabled bool true
.caps.config.image.sysimg.alarms.humidity.maxCount int32 1
.caps.config.image.sysimg.alarms.insulation entry
.caps.config.image.sysimg.alarms.insulation.enabled bool true
.caps.config.image.sysimg.alarms.insulation.maxCount int32 1
.caps.config.image.sysimg.irMarkers entry
.caps.config.image.sysimg.irMarkers.enabled bool false
.caps.config.image.sysimg.irMarkers.spot entry
.caps.config.image.sysimg.irMarkers.spot.enabled bool false
.caps.config.image.sysimg.irMarkers.spot.maxCount int32 0
.caps.config.image.sysimg.irMarkers.arrow entry
.caps.config.image.sysimg.irMarkers.arrow.enabled bool true
.caps.config.image.sysimg.irMarkers.arrow.maxCount int32 4
.caps.config.image.sysimg.irMarkers.box entry
.caps.config.image.sysimg.irMarkers.box.enabled bool false
.caps.config.image.sysimg.irMarkers.box.maxCount int32 0
.caps.config.image.sysimg.measureFuncs entry
.caps.config.image.sysimg.measureFuncs.enabled bool true
.caps.config.image.sysimg.measureFuncs.diff entry
.caps.config.image.sysimg.measureFuncs.diff.enabled bool true
.caps.config.image.sysimg.measureFuncs.diff.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.diff.calcMask int32 65526
.caps.config.image.sysimg.measureFuncs.isotherm entry
.caps.config.image.sysimg.measureFuncs.isotherm.enabled bool true
.caps.config.image.sysimg.measureFuncs.isotherm.calcMask int32 20
.caps.config.image.sysimg.measureFuncs.isotherm.dual bool false
.caps.config.image.sysimg.measureFuncs.isotherm.fixScale bool false
.caps.config.image.sysimg.measureFuncs.isotherm.interval bool true
.caps.config.image.sysimg.measureFuncs.isotherm.invInterval bool false
.caps.config.image.sysimg.measureFuncs.isotherm.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.mbox entry
.caps.config.image.sysimg.measureFuncs.mbox.enabled bool true
.caps.config.image.sysimg.measureFuncs.mbox.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mbox.maxCount int32 5
.caps.config.image.sysimg.measureFuncs.mcircle entry
.caps.config.image.sysimg.measureFuncs.mcircle.enabled bool false
.caps.config.image.sysimg.measureFuncs.mcircle.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mcircle.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.mline entry
.caps.config.image.sysimg.measureFuncs.mline.enabled bool true
.caps.config.image.sysimg.measureFuncs.mline.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mline.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.reftemp entry
.caps.config.image.sysimg.measureFuncs.reftemp.enabled bool true
.caps.config.image.sysimg.measureFuncs.reftemp.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.reftemp.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.script entry
.caps.config.image.sysimg.measureFuncs.script.enabled false
.caps.config.image.sysimg.measureFuncs.script.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.spot entry
.caps.config.image.sysimg.measureFuncs.spot.enabled bool true
.caps.config.image.sysimg.measureFuncs.spot.calcMask int32 514
.caps.config.image.sysimg.measureFuncs.spot.maxCount int32 5
.caps.config.image.sysimg.visualMarkers entry
.caps.config.image.sysimg.visualMarkers.enabled bool false
.caps.config.image.sysimg.visualMarkers.spot entry
.caps.config.image.sysimg.visualMarkers.spot.enabled bool false
.caps.config.image.sysimg.visualMarkers.spot.maxCount int32 0
.caps.config.image.sysimg.visualMarkers.arrow entry
.caps.config.image.sysimg.visualMarkers.arrow.enabled bool false
.caps.config.image.sysimg.visualMarkers.arrow.maxCount int32 0
.caps.config.image.sysimg.visualMarkers.box entry
.caps.config.image.sysimg.visualMarkers.box.enabled bool false
.caps.config.image.sysimg.visualMarkers.box.maxCount int32 0
.caps.config.image.sysimg.gps entry
.caps.config.image.sysimg.gps.enabled bool false
.caps.config.image.targetNoise entry
.caps.config.image.targetNoise.enabled bool false
.caps.config.image.targetNoise.targetNoiseMk int32 0
.caps.config.image.zoom entry
.caps.config.image.zoom.enabled bool true
.caps.config.image.zoom.maxFactor double 8
 # ID 62100eev
 # CRC01 33vb10ge

For once the noise generator is not enabled...

There doesn't appear to be much to hack in terms of features, but UltraMax is definitely interesting - 4x the effective resolution on >9Hz cameras, for free, based only in camera firmware.

Here is the official FLIR link for the 1.38.21 firmware:
http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_t420-t440_pn62101_02_v1.38.23_update_pack.zip (http://cdn.cloud.flir.se/swdownload/assets/cameradownload/flir_t420-t440_pn62101_02_v1.38.23_update_pack.zip)

Does anybody have any ideas on what is going on here?
Title: Re: FLIR T440bx hacking - firmware investigation, possible UltraMax support for Exx
Post by: Chanc3 on February 02, 2018, 10:39:57 pm
Alas the older models (pre 2014) don't have the actual physical hardware to support the UltraMax feature (nor MSX).

Not sure what is going on with your firmware however... That is a mystery!
Title: Re: FLIR T440bx hacking - firmware investigation, possible UltraMax support for Exx
Post by: Spirit532 on February 02, 2018, 10:48:52 pm
Alas the older models (pre 2014) don't have the actual physical hardware to support the UltraMax feature (nor MSX).

My T440bx supports all three - isotherms, picture in picture, and MSX, so I'm assuming UltraMax is possible too.
My model is also listed as supporting UltraMax - but this firmware version is a mystery.
Title: Re: FLIR T440bx hacking - firmware investigation, possible UltraMax support for Exx
Post by: Chanc3 on February 02, 2018, 10:54:37 pm
Alas the older models (pre 2014) don't have the actual physical hardware to support the UltraMax feature (nor MSX).

My T440bx supports all three - isotherms, picture in picture, and MSX, so I'm assuming UltraMax is possible too.
My model is also listed as supported - but this firmware version is a mystery.
Interesting! It wasn't really until 2014 that MSX was released. Have you looked at the gui.cfg file?
Title: Re: FLIR T440bx hacking - firmware investigation, possible UltraMax support for Exx
Post by: Spirit532 on February 02, 2018, 11:01:46 pm
Have you looked at the gui.cfg file?

There is no such file in my dump.

However, there is .system/ui.d/config.d/conf.cfg, and that file contains an interesting line:
Code: [Select]
.caps.config.save.fastShoot bool false
Could this be the UltraMax feature?
Title: Re: FLIR T440bx hacking - firmware investigation, possible UltraMax support for Exx
Post by: Chanc3 on February 02, 2018, 11:08:52 pm
I've seen that on our T620, but alas it doesn't seem to do anything!
Title: Re: FLIR T440bx hacking - firmware investigation, possible UltraMax support for Exx
Post by: Spirit532 on February 02, 2018, 11:23:43 pm
I've seen that on our T620, but alas it doesn't seem to do anything!

Can confirm, just checked. Neither "fastshoot" nor "panorama" do anything, they're the only two disabled options in ui/conf.cfg
The CRC01 process works, plain and simple. No need to touch the dlls.

Going to touch a few other files now, to see if something changes.
Title: Re: FLIR T440bx hacking - firmware investigation, possible UltraMax support for Exx
Post by: Fraser on February 02, 2018, 11:34:38 pm
In situations like this I would normally contact FLIR support requesting clarification on the firmware version that I have, and can upgrade to. You may have a problem on this front due to your location however.

FLIR do not list their previous firmware versions so it does not mean much if you cannot find it mentioned anywhere.

It is definitely not a good idea to load an incorrect firmware version in the hope that it will work. That path can lead to much sorrow if the camera is not smart enough to abort the operation before it is completed. This is especially so with your camera having an 'unusual' firmware version that is not available as a download. You have tried the 'official' firmware version for your camera part number so it really is a case of stick with what you have, or contact FLIR for help getting the correct firmware. The downloaded firmware could even be corrupt on their servers.

You may also wish to investigate the cameras Service Menu for the option to enable the higher temperature range.

Fraser

Title: Re: FLIR T440bx hacking - firmware investigation, possible UltraMax support for Exx
Post by: Spirit532 on February 03, 2018, 12:01:35 am
In situations like this I would normally contact FLIR support requesting clarification on the firmware version that I have, and can upgrade to. You may have a problem on this front due to your location however.
Already done. I doubt they'll help anyway, but I did open up a ticket and register my camera.

FLIR do not list their previous firmware versions so it does not mean much if you cannot find it mentioned anywhere.
There is a leaky XML file on their site(that opens automatically when you click "update") that lists all the versions if you look around. Mine is definitely not listed there >_>

You may also wish to investigate the cameras Service Menu for the option to enable the higher temperature range.
The "bx" has the range enabled and calibrated by default :)



As for the hack - this version of the firmware is completely insecure.
Short guide for software version 1.4.1 only(untested on others):

1) Back up the filesystem(configs especially) via RNDIS.
2) Edit the .cfg however you want, enabling all features still works. Be sure to increase the max counts too :)
3) Remove the line containing "# CRC01" from the file, so that the line containing "# ID" is followed by a newline.
4) Run "crc01.exe conf.cfg", copy the "# CRC01" line it gives you back into the file after "# ID". Make sure there's a newline after it.
5) Reupload the file back to the camera. Make sure to overwrite.
6) Power the camera off, then pull the battery out(important).
7) Put the battery back in, turn it on, enjoy the hack.



Now we need more insight into the firmware updates - this version barely has any hackable features(the most useful is a measurement circle, lol).
GPS is not available despite what the config says, or so it appears - I see no info related to it in the UI, but I'll dig further.
Title: Re: FLIR T440bx hacking - firmware investigation, possible UltraMax support for Exx
Post by: Spirit532 on February 03, 2018, 03:07:20 am
Another oddity.
The web service menu is there, but entirely protected by a password(not blank), and it is not "IRCAM", "3vlig", or "1235". These guesses were under the user "flir", which seems to be universal across their entire portfolio.
Title: Re: FLIR T440bx hacking - firmware investigation, possible UltraMax support for Exx
Post by: Spirit532 on February 05, 2018, 03:16:33 pm
Here's an addition for the hack:
Since the preview JPEG quality is so low(usually 85%), I made a user preset to increase it to 100%
(https://i.spirit.re/rtqec.png)

To do this I'm using an unlisted preset - "$preset_estimate_max_load", which is not present in the files.
Inside that I created a "user.rsc" with the following code:
Code: [Select]
#
 # Generated at 2011-01-26 11:13:54
 #
.image entry
.image.services entry
.image.services.store entry
.image.services.store.quality int32 100
 # CRC01 12ad0621


Should be pretty self-explanatory.
Attached is a file for lazy hacking - just extract the contents of the folder into /system/ on your camera(it should ask to overwrite 1 file), cold reboot(by removing battery).

If done correctly, and your camera is set to English, you should see this in your preset menu:
(https://i.spirit.re/wb7yo.png)

It has to be run every time you change modes.
Title: Re: FLIR T440bx hacking - firmware investigation, possible UltraMax support for Exx
Post by: Spirit532 on February 06, 2018, 06:41:46 pm
Alas the older models (pre 2014) don't have the actual physical hardware to support the UltraMax feature (nor MSX).

Just received a reply from FLIR - my T440bx is an older 62101-0701, which does not support UltraMax.
The 62103-xxxx and 62104-xxxx support UltraMax, and it's a five hundred dollar option to purchase.

They still have no idea on the software version though, waiting for more info.

I guess the original topic of this thread is going to change a little - DIY UltraMax!
I have an idea on to do this on any 30/60Hz capable camera, will update soon if it works out.
Title: Re: FLIR T440bx hacking - firmware investigation, possible UltraMax support for Exx
Post by: Spirit532 on February 07, 2018, 02:25:46 am
Update soon, as promised!  ;D

A custom hack menu is likely possible.(see edit)

Managed to build a full WinCE application including the full SDK. Lots of possibilities from here on out.
Still working out the application window focus kinks. Right now moving or interacting with the menu immediately brings it to the foreground where it's impossible to manipulate.

(https://i.spirit.re/qkPJB.png)

EDIT: A custom menu hack is possible, including keyboard hooks, windows, and UI elements.
I don't see a reason as to why this isn't reproducible on the Ex(!!!) and Exx series cameras as well.
More info as soon as I get it to be stable in the foreground.
Title: Re: FLIR T440bx hacking - firmware investigation, possible UltraMax support for Exx
Post by: David C on February 07, 2018, 07:39:32 am
Just to make sure I'm following, you're looking into a possible user "add-on" for the Ultramax feature that could work for both Ex and Exx series ? Meaning an E8+ could possibly feature the Ultramax 4x resolution upscaling in a near future ?
Title: Re: FLIR T440bx hacking - firmware investigation, possible UltraMax support for Exx
Post by: Bud on February 07, 2018, 02:25:52 pm
I remember seeing somewhere that superresolution end image is not produced on the camera, all the camera does is captures a stack of images, the combined image is then generated by Flir software outside of the camera. Can't remember where i saw it and for what camera model.
Title: Re: FLIR T440bx hacking - firmware investigation, possible UltraMax support for Exx
Post by: Spirit532 on February 07, 2018, 02:37:51 pm
Just to make sure I'm following, you're looking into a possible user "add-on" for the Ultramax feature that could work for both Ex and Exx series ? Meaning an E8+ could possibly feature the Ultramax 4x resolution upscaling in a near future ?

Correct.
Also, as seen in the previous post, a huge variety of different hacks become possible once a stable, non-glitchy custom window is available(right now I'm battling with uicore.exe stealing app focus away).

I remember seeing somewhere that superresolution end image is not produced on the camera, all the camera does is captures a stack of images, the combined image is then generated by Flir software outside of the camera. Can't remember where i saw it and for what camera model.

Correct.
An UltraMax image is a standard FLIR radiometric image that has 16 lossless JPEGs(JPEG-LS) images embedded in it as a sequence, in addition to one standard 16-bit radiometric raw.
I've managed to separate them out, but I have not yet figured out a way to construct an UltraMax image due to the JPEG-LS filesize being non-constant(so a simple binary replacement won't work).
Title: Re: FLIR T440bx hacking - firmware investigation, possible UltraMax support for Exx
Post by: David C on February 07, 2018, 04:54:09 pm
Back from my college days in graphic design, we had a third-party Photoshop plugin called Fractal made by OnOne. Fractal is an upsizing algorithm that creates new pixels to bridge the gaps and back in 2010 it was pretty amazing how good it worked, even with small resolution files. Good enough to the point where you could turn a web image into a printable one. I figured such algorithm was used for the Ultramax and other similar upscaling of thermal imager ? However you mention that in addition of upscaling a single jpeg, it overlays 16 other jpeg to fill in the radio metric data of the created pixels ?
Title: Re: FLIR T440bx hacking - firmware investigation, possible UltraMax support for Exx
Post by: Spirit532 on February 07, 2018, 05:04:35 pm
UltraMax(and Testo's SuperResolution, same thing basically) rely on the tiny hand movements between frames to basically put the sensor pixels themselves "between" the gaps - effectively increasing the pixel density.
The idea is to not only get a higher resolution, "fake" upscaled image - but actual sub-pixel radiometric values.

It's a mix of supersampling and deconvolution, just lots math.
Title: Re: FLIR T440bx hacking - firmware investigation, possible UltraMax support for Exx
Post by: David C on February 07, 2018, 05:08:52 pm
You said it could work on 30hz and above imagers, but what about the 9hz Ex series ? Perhaps the results would be less dense ?
Title: Re: FLIR T440bx hacking - firmware investigation, possible UltraMax support for Exx
Post by: Spirit532 on February 07, 2018, 05:48:37 pm
The goal is the same - to capture 16 slightly different images.
I'm assuming you'll just have to have very steady hands for ~2 seconds :)
Title: Re: FLIR T440bx hacking - firmware investigation, possible UltraMax support for Exx
Post by: David C on February 07, 2018, 06:26:09 pm
That works for me. I'm guessing it's not gonna be effective on moving objects and targets with temp variations above 9hz ?
Title: Re: FLIR T440bx hacking - firmware investigation, possible UltraMax support for Exx
Post by: Spirit532 on February 07, 2018, 06:37:30 pm
Definitely not. This is very much a "still image" thing, even on 30/60Hz devices.
Title: Re: FLIR T440bx hacking - firmware investigation, possible UltraMax support for Exx
Post by: David C on February 07, 2018, 06:53:37 pm
I'd be interested in doing some amateur photography with my E8+, so 4x upscaling would serve the purpose nicely, despite the low end output of the Ex imager. Let me know if you need some funding in your research !
Title: Re: FLIR T440bx hacking - firmware investigation, possible UltraMax support for Exx
Post by: Spirit532 on February 07, 2018, 06:59:14 pm
I might need help with testing on other hardware(namely the Ex and Ex0), but I am far from done right now.
I've got the keyboard hook working though, all of the controls register as separate buttons! :)
Still fighting the GUI.
Title: Re: FLIR T440bx hacking - firmware investigation, possible UltraMax support for Exx
Post by: David C on February 07, 2018, 07:19:05 pm
I am not wizz enough in the coding department, however I can navigate my way trough file logs and html type of stuff, as well as poke around folders if I know I'm not gonna mess anything up on the camera itself. I think Bud with his E4+ wifi will be the man to do the Ex testing, but feel free to ask what you need and I'll do what I can to make it happen.
Title: Re: FLIR T440bx hacking - firmware investigation, possible UltraMax support for Exx
Post by: Spirit532 on February 07, 2018, 07:20:18 pm
I'll post an update here when I have something more interesting to show. I'm really going for a custom GUI called up by a key combination or double click - the rest is pretty simple.
Title: Re: FLIR T440bx hacking - firmware investigation, possible UltraMax support for Exx
Post by: Spirit532 on February 08, 2018, 10:32:07 pm
The Ex and Exx camera custom menu is a go!
Here is what I have accomplished at the time of writing this post:

What I don't have at the moment:

I have made a short video to demonstrate the hack functioning on the camera.
Please note that while I am launching this hack via telnet, the end result should be just a few file replacements(like with the regular E4 hack, but without CRCs), and a single telnet command to install the hack, making it persist across reboots without any user intervention.

In this particular case, the hack was configured to open the menu on a 2-second press of the joystick.

https://www.youtube.com/watch?v=Feowt0D9APw (https://www.youtube.com/watch?v=Feowt0D9APw)

Let me know if there are any specific features you'd like to see implemented.
Title: Re: FLIR T440bx hacking - firmware investigation, possible UltraMax support for Ex
Post by: Spirit532 on February 09, 2018, 02:50:56 am
Another small update.


https://www.youtube.com/watch?v=MlW7O5ojzIM (https://www.youtube.com/watch?v=MlW7O5ojzIM)
Title: Re: FLIR T440bx hacking - firmware investigation, possible UltraMax support for Ex
Post by: Spirit532 on February 10, 2018, 06:02:54 am
I've written a small key mapping app to determine the keyboard layout on FLIR Txxx/Ex/Exx series cameras. It should be compatible with any ARMV4I device running Windows CE 5.0 and higher, but I assume no responsibility for anything that might happen when you run it.

If you would like the hack application to run on your camera model, please use this tool on your camera and record which keycode the buttons represent.

(https://i.spirit.re/qWjRv.png)

A short guide on how to do this:

Download here:
https://spirit.re/projects/files/wince_key_mapper/keymapper.exe

More info here (https://spirit.re/projects/wince_key_mapper.php).
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: David C on February 10, 2018, 06:17:52 am
Cool work, I'm excited to see what comes next !
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: Spirit532 on February 15, 2018, 08:34:19 pm
I believe I have enough features implemented in this app to begin testing compatibility with other devices(Ex and Exx cameras).

If anyone is interested and has a device that they would like to test on, please reply in this thread and I'll PM you with further info.
For now the testing will be done in private, but I do plan on releasing this publicly, for free.

(https://i.spirit.re/Jxmel.png)

Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: David C on February 15, 2018, 10:23:44 pm
Interested with E4 wifi
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: Spirit532 on February 16, 2018, 03:40:09 am
PM sent! Still looking for more people though.

Also added another feature - an automatic focus stacker/racking tool that creates a 60-frame sequence as it pulls through the entire focus range of the camera(Txxx only, because this needs autofocus).
https://www.youtube.com/watch?v=FC2Z9HGUwiw (https://www.youtube.com/watch?v=FC2Z9HGUwiw)

Now comes the hard part - creating something to read and export the ".seq" files created by the camera, do stacking(or superresolution), and then convert them into standard radiometric JPEGs or something like that.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: tomas123 on February 16, 2018, 10:39:22 am
Now comes the hard part - creating something to read and export the ".seq" files created by the camera, do stacking(or superresolution), and then convert them into standard radiometric JPEGs or something like that.

I posted last 5 years something in this forum about .seq, stacking, ultramax and creating FLIR radiometric JPEGs from 16 bit tiff files.
I can help you, to find this bread crumbs ;-)
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: Spirit532 on February 16, 2018, 02:10:52 pm
I've read your posts during the creation of this hack, they've been quite helpful. PM sent about the other stuff.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: David C on February 20, 2018, 02:27:52 am
Here's the tree file from my E4 wifi with advanced package upgrade. I blacked out the serial number and SUID with XXX's.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: Spirit532 on February 23, 2018, 08:18:49 pm
Small update: The hack is now compatible with the Ex-series cameras, thanks to David C.

If anyone has an Exx-series camera and would like to help test the hack, please PM me with your Skype username or other preferred method of realtime contact.

I will be releasing the hack publicly and will start accepting feature requests once the Exx version is fully functional.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: David C on February 27, 2018, 02:54:15 am
Spirit's work is wonderful, it would be great if someone with an Exx camera could join in. The hack really maximize the camera potential.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: Chanc3 on February 27, 2018, 07:24:18 am
I have an Exx, P6xx, A6xx and T6xx camera available, that I can try and see if u can get this on. Obviously, they are units in service currently, so would need to make sure a) free for testing b) I have permission to test on.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: Spirit532 on February 27, 2018, 10:22:11 am
Another E4 Wifi test successful, this time by the user "Myself"

I have an Exx, P6xx, A6xx and T6xx camera available, that I can try and see if u can get this on. Obviously, they are units in service currently, so would need to make sure a) free for testing b) I have permission to test on.

PM Sent!
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: Spirit532 on February 28, 2018, 11:19:17 pm
Another update.
The hack has been tested successfully to be fully compatible with FLIR T4xx, Ex Wifi, and Exx cameras, independent of firmware versions.

It will be released as soon as I have a full tutorial and user guide written up, to make sure it's simple to set up.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: Sparky on March 11, 2018, 12:02:57 am
Hello Spirit532

Amazing accomplishment here and cool to see your in-progress videos!  I have just purchased Flir E4 WiFi and will get in a few days.  It looks like you already completed the testing to ensure compatibility with this camera, but if you need another test data point just PM me :)

I notice your work here supports many camera models, but I am wondering in-relation to Flir E4 WiFi, how does this approach compare to the alternative of Bud detailed here (https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1336326/#msg1336326).  I guess I cannot run both...so I am curious of the differences.  Could you summarize?

In the meantime I will wait for my camera to arrive! :D
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: Spirit532 on March 11, 2018, 12:53:34 am
You can run both, I've ensured (almost) complete compatibility with Bud's hack. It's meant to go on top of Bud's hack on cameras where it exists(Ex and Exx), to extend functionality to that which cannot be done with static UI edits.
The hack is almost ready to run on all three series, I'm just a bit busy at the moment so I don't have time to write up a use/installation guide, without which the hack is somewhat pointless as it needs persistence(over reboots).
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: Sparky on March 11, 2018, 01:07:14 am
You can run both, I've ensured (almost) complete compatibility with Bud's hack. It's meant to go on top of Bud's hack on cameras where it exists(Ex and Exx), to extend functionality to that which cannot be done with static UI edits.
The hack is almost ready to run on all three series, I'm just a bit busy at the moment so I don't have time to write up a use/installation guide, without which the hack is somewhat pointless as it needs persistence(over reboots).

Wow! I didn't expect that it was possible to run both!  Amazing that this is an "add on" pack to Bud's work!  Will be great to read a little summary of the additions added by your work.  Hopefully you can include in your write-up when you get a chance.

Cheers!
Sparky
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: zucca on April 06, 2018, 05:39:34 pm
Let me know if you need someone to test a E30 (now E60+)

SN 490214xx
PN 49001-1801
FW 2.23.14
Model E30_B 1.1

If don't need it, I will just sit back and wait for the official release.

Many thanks in advance for your hard work.

Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: zucca on April 06, 2018, 09:09:29 pm
PS: VNC on Win CE?

http://efonvnc.sourceforge.net/ (http://efonvnc.sourceforge.net/)

https://developer.toradex.com/knowledge-base/VNC-Server-(WinCE) (https://developer.toradex.com/knowledge-base/VNC-Server-(WinCE))

https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg686126/#msg686126 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg686126/#msg686126)

ohhhh look at this...

https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg390927/#msg390927 (https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg390927/#msg390927)

but no IR image bummer!
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: Spirit532 on April 06, 2018, 10:05:26 pm
My app is ready to run, it's just difficult to set up and doesn't have many features(UltraMax is nowhere to be seen still, aside from 16-image capture).

As for VNC - yes, it's possible. You're going to get a happy WinCE image that is about as useful as you can expect a completely blank WinCE install without a desktop to be. With very angry authoritative graphics that will override your display even when you don't want them to.
You can run Doom on them as well, just drop in the additional graphics libraries. I got it to run, but couldn't get it to load the game WAD and couldn't be bothered to recompile the entirety of a Doom CE port to fix file system issues ;D
Most native WinCE games and apps will work on these cameras, you can definitely have a lot of fun doing some things.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: kaz911 on April 23, 2018, 01:49:53 pm
Hi Spirit532,

I have a "virgin" E50bx Mk1 I can try it on. Any idea if you are close to being ready? :)

/k
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: Spirit532 on April 23, 2018, 01:51:37 pm
Hi Spirit532,

I have a "virgin" E50bx Mk1 I can try it on. Any idea if you are close to being ready? :)

/k

You'll want to hack it to E60bx+, my app doesn't do that. It only expands upon the existing hack functionality.
As for readiness, probably soon. Overloaded with work and real life right now.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: Spirit532 on June 17, 2018, 07:16:47 pm
Big update: The hack has been released! For more information, downloads, and full tutorial, go to https://spirit.re/projects/flir_hack.php (https://spirit.re/projects/flir_hack.php)

Video tutorial(referencing the page):
https://www.youtube.com/watch?v=xa6AF0nW4AU (https://www.youtube.com/watch?v=xa6AF0nW4AU)

Yes, I know there's a typo in the video.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: Vipitis on June 17, 2018, 10:36:53 pm
Great work. I hope the project continues. The best offer for a Txx series I ever found was a T420 for 5000€ + tax. And I can't justify. But I was wondering.
Could you mess with exposure time? That would make astronomy possible.
You wrote about using grid party rendering and superresolution. Would that be similar to the ThermalCamera+ app or something else?
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: Spirit532 on June 18, 2018, 06:13:27 am
No, these sensors don't have any low level control - all that is done in the FPGA.
I'm not sure what grid party rendering is, but superresolution is increasing the actual radiometric resolution by 4x(so 320x240 turns into 640x480) by means of supersampling and then deconvolution. I haven't implemented that yet, as I'm not that good with code.

As for the offer - this hack works on all Ex/Exx cameras as well, including the E4-8.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: eKretz on June 18, 2018, 09:20:56 am
Awesome job! Thanks for the effort. So the UltraMax (assuming this is what you're meaning when you say superresolution) is working or not working? I will try this out tomorrow on my E40.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: Spirit532 on June 18, 2018, 09:24:47 am
At the moment, the hack is only capable of outputting a burst of 16 images to the specified folder. There is no post-processing software that would allow you to create final superresolution images yet.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: eKretz on June 18, 2018, 03:15:47 pm
Gotcha. I wonder if there's a way to see how the Tools+ software is doing it for the cameras that are capable and tricking it into working for the others.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: Spirit532 on June 18, 2018, 03:23:41 pm
I explained that a bit in my article - take a closer look.
The images my hack takes are directly compatible with the UltraMax JPEGs (even)higher end cameras generate, but the formats are different.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: eKretz on June 19, 2018, 08:58:28 am
Got it. Looks promising, and there is a way to do super-resolution with Photoshop with those 16 images.

On another note, I just finished attempting to do the hack, and it isn't working for me on my "E60+ upgraded" E40. Holding the "Back/Menu"  button and pressing the down arrow and releasing results in...nothing at all. I was wondering about the applaunch.dat append though - should that be "# Start hack.launcher" like you have it in the sample? or "# Start Hack.exe" like would seem to be correct?
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: eKretz on June 19, 2018, 09:25:50 am
Hmm. Decided to try the other method with presets but there's a problem there as well. Your install instructions say for the second method to add the $preset_estimate_max_load folder into /FlashFS/system/profile.d folder. There isn't one on my cam. Presets aren't even normally there in my camera menu unless I enable them in the UI config file - and then the menu entry is just empty. I did try enabling the presets option in the config file and re-running the CRC01 for the correct CRC but the "Back/Menu" plus down arrow combo still does nothing. I am running the 2.23.14 firmware.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: Spirit532 on June 19, 2018, 09:35:41 am
Ah, that's right, my bad. It should be "hack", not launcher. Fixed. The "# Start hack." is a comment.
I've uploaded the fix to the site as well.

As for $preset_estimate_max_load - please read the instructions carefully, or watch the video again.
You have to replace an existing preset in the case that adding a preset doesn't work. Also, if your camera is CRC01, you should be able to use applaunch, since it isn't signed.

To check whether the hack is running, you can connect to the camera via telnet and run "ps". "hack.exe" should be in the process list.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: eKretz on June 19, 2018, 10:01:05 am
In the case of $preset... you misunderstand - there IS no profile.d in my camera.

In the case of the "hack" vs. "launcher" issue - I just tried fixing that and although it changed things, still not working.  The camera went through normal boot-up except a black screen appeared rather than (or maybe right after) the normal blue one with Flir welcome to infrared blah blah. The progress bar did its thing and the normal infrared camera screen came up and is displaying image and temp etc. .However, the regular menu buttons aren't working at all. I can't bring up any menu. Also tried the "Back/Menu" plus down arrow and when I do that the screen just goes blank of all text and temp info. If I then hit the back button again, the spot, temp and temp scale come back but still can't open the menu. Only way out is a hard power down with 10 second power button press. Just reverted to original applaunch.dat and eveything is working fine again,but of course no hack.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: Spirit532 on June 19, 2018, 10:12:23 am
In that case, try placing this launcher.exe next to hack.exe and replacing "hack" with "launcher" in applaunch.dat
https://i.spirit.re/cPvpz.zip
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: eKretz on June 19, 2018, 10:52:59 am
AARGH! Still not there, but closer. OK, now I'm getting the normal boot screen all the way through to the camera coming on. The menu buttons are now working correctly. I can now open the hack menu with the "Menu/Back" button + down arrow combo. I can scroll and select options with OK button. I can back out of the menu with the "Back/Menu" button. But, When I get back out of the menu with the Super-resolution function enabled, pushing the "Up" arrow does nothing. No activity light on the memory card and no images saved to the ImageSequences folder. I even tried holding the "Menu/Back" button and pressing the "Up" arrow, and that goes "Beep, Beep" but no memory card activity light and no images in the ImageSequences folder. I also noticed at least one of the options isn't there, like the "FLIR Logo" checkbox - not sure if that's intentional though.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: Spirit532 on June 19, 2018, 10:56:17 am
You have to hold the back button while activating the functions. Otherwise it interferes with other menus.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: eKretz on June 19, 2018, 11:15:49 am
Like I said, tried that too. Still no dice. All I get is a couple of beeps and no photos in the ImageSequences folder. And I double-checked that the slashes were the correct way and that the filename matches. Here's the contents of the hack.ini - is all of this correct? What's with the FLIR logo option missing in the hack menu? That only for certain models?

[hackOptions]
disable_nuc = false
record_sequence = false
flir_logo = true
max_jpeg_quality = true
record_stack = false
save_path = \StorageCard\DCIM\ImageSequences
programmable_msx = true
defaultZoomLevel = 1
[buttonDefinitions]
joybutton = 13
backbutton = 112
joyup = 38
joydown = 40
joyleft = 37
joyright = 39

Also, I noticed that sometimes when I go into the hack menu, it disappears except for the bottom white line with the URL. If I then push the up or down arrow keys, each option that is highlighted as I scroll through will come back and stay there, but the header never comes back.  The "Back/Menu" + Right/Left arrow combo does work for the zoom option, but MSX alignment just seems to zoom the visual/digital camera when in PIP mode (My cam is the older version without MSX except for in FLIR Tools).
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: Spirit532 on June 19, 2018, 11:38:23 am
That's odd - both "record_stack" and "record_sequence" are set to false, but beeps are happening. Are you sure it's enabled? Try turning off and on again, see if that outputs a .seq. You want to record a sequence(superrres).
The FLIR logo option should be there on all models - I'll check once I have a bit more time.
As for the menu disappearing - the visuals should disappear before the menu opens, because that causes interference. It should still function, just a rendering glitch.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: eKretz on June 19, 2018, 12:03:06 pm
That's just the default .ini. Just wanted to make sure there were no errors there. The camera only beeps when the option for superresolution is toggled on - I tried it both ways. Getting beeps but no pictures with the option toggled on; no beeps and no pictures with the option toggled off. I have also tried power cycling multiple times with no result. One time the power button stopped working and had to do a hard power down, then everything was back to normal on restart. The option for the FLIR logo has never been in the menu on any of the varied attempts.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: Spirit532 on June 19, 2018, 12:06:17 pm
It could be that it isn't liking the path. Try putting it somewhere not on the SD card, but on camera flash.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: eKretz on June 19, 2018, 12:09:50 pm
Good idea, will try that next. My battery is just about toast so I'll try changing the save directory to flash later after it recharges and report back.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: eKretz on June 19, 2018, 09:23:04 pm
OK, nope that doesn't work. I tried adding the ImageSequences folder in a couple different places and no dice. Tried in flash and the new folder seems to get instantly erased on reboot - even tried several different folders. Tried changing the save directory to the default "Dir A" folder on the storage card, no deal there either. No matter which way I tried, always the same result - two beeps and no photo sequence saved. Not sure why the new folder isn't persistent in flash memory.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: Spirit532 on June 20, 2018, 06:27:20 am
There are file system protections, so it can be normal - however, photos not saving to the SD card is really odd, because in all of my tests they worked.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: eKretz on June 20, 2018, 09:30:24 am
Out of curiosity, did you try all the versions of E40? From what I understand there were a few different hardware versions. Also, could firmware version make a difference?
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: Spirit532 on June 20, 2018, 09:56:44 am
No, I wasn't able to get every version of every camera :P
It's odd though. You should have write privileges. Try storing directly into DCIM, a folder that already exists. Also try with trailing backslash and without.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: Nicosrap on October 04, 2018, 07:31:47 pm
http://subirimagen.me/uploads/20181004142641.25 (http://subirimagen.me/uploads/20181004142641.25)

Dear as I can update or install new firmware.
I'm from Chile, try to log in via FTP but the password goes wrong
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: chili_red on October 13, 2018, 03:20:49 pm
I recently acquired a B300, 45306-1600X1, SW version 9.4.5, Camera revision 01.
Any possibility your hack will work in that?
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: Spirit532 on October 22, 2018, 10:43:06 pm
Any possibility your hack will work in that?

Nothing is stopping you from trying, it's non-destructive - but be aware that you need a reliable backup in case you get stuck on boot.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: renehdez on January 01, 2019, 07:45:46 pm
Hi, I'm new to the forum, I want to ask for your advice on a Flir T630 camera, try to update it but in the process it will go off and I will not restart it, it will be on again and the screen will appear with the start process bar that looks like finish but there it stays, the camera does not show the menu of the camera. Do you know in some way to reprogram it to work again? I thank you in advance for your attention.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: Bud on January 01, 2019, 07:53:07 pm
Do not post same question in multiple threads, it is not welcomed in this forum.
Title: Re: FLIR T440bx hacking - custom application for Ex/Exx/Txxx cameras, UltraMax
Post by: ir.ukrm on August 05, 2019, 10:42:53 am
Is there any way in the firmware to make notes in Russian?