I don't really mind making it public, I just didn't want to put it in the write-up in case people copy&pasted it without understanding fully.
The general command structure is a command name, then either a ':' for a 'set' command or a '?' for a query command. For example: "digital:on" turns on the digital output, and "digital?" queries the current state.
There are two memory commands, "MEM" and "MEMW". "MEM" works on bytes and "MEM" works on words (2-byte integers for this platform).
The mem query command takes two arguments, an address and a length (both in hex). If the length is not specified, it defaults to 4.
The mem write command takes an address in the first argument, then up to 4 more arguments with values to be written in sequence starting at that address.
For example:
"MEM?aabb,10" reads 16 bytes from address 0xAABB
"MEM:1000,1,2,3" writes 0x1 to 0x1000, 0x2 to 0x1001, 0x3 to 0x1002
This is the python script I used to dump the firmware:
import serial
def readline(ser):
line = ser.readline()
ser.read(1) # read extra \r
return line
def readblock(ser, addr, length):
lines = int(length / 16)
ser.write(bytes("mem?{:x},{:x}\n".format(addr, length), 'ascii'))
data = b''
for i in range(lines):
line = readline(ser)
# print(line)
data += bytes.fromhex(line[:-2].decode('ascii').replace(' ', ''))
cmd = readline(ser)
print(cmd)
ok = readline(ser)
print(ok)
return data
# Use the BAUDRATE command to change from 19200 to 38400 before using this script.
# Change start & length to pick a block of memory to dump.
if __name__ == '__main__':
ser = serial.Serial('/dev/ttyUSB0', 38400, timeout=1)
ser.readline()
blocksize = 1024
start = 0x0
length = 0x400000
with open('flir-memdump-{:x}-{:x}.bin'.format(start, length), 'wb') as f:
for i in range(start, start + length, blocksize):
print('Getting block ' + str(i))
f.write(readblock(ser, i, blocksize))