Infiray C210 Thermal Camera review

[optotester]

Script is only executed when switching to USB Disk mode using the app. It is not executed from the SD.
Basically file is copied to the device and replace the script used when selecting the USB Disk mode. Most likely this file does not have the same name with your firmware version, hence it is not loaded when selecting USB Disk mode.

I could put the script in apps.sh instead but if the iray app has a different name that my camera it will basically stop it from running - and the app is used to manage firmware upgrade - so the risk of bricking the device would be too important, which is why I did not take the risk. Plus, by overwriting apps.ah we won’t be to take a backup of it. I will try to add a small qt app with a message box to confirm if script is running or not.

Camera have serial exposed by default so it does not mean that script was executed. By default, no terminal is running on it. To progress further you would need a backup taken from UBoot to look at the file structure (best) or at least a listing of files in /etc/rc.d by connecting with the LVTTL header (easier) with ftpadmin/ftpadmin user (which exists by default).

[keenox]

On C200 (which I have) there is no switching to disk mode. It is always in disk mode.
Also, I tried renaming the script to apps.sh and it behaves the same (nothing). Also tried a little script which should create a new file in the same directory and also didn't seem to work (tried both your name and apps.sh). Didn't know it copies the apps.sh from the Upgrade folder, but it seems it didn't on my end, because it would have been bricked already (thanks for letting me know btw).

I could take mine apart, but don't see any screws beside the ones that hold the USB port and MicroSD slot. I think I might be able to take a backup of the flash if it is discrete or connect via JTAG (I think I have a small JTAG adapter, but never used it).

[optotester]

There are 6 screws behind the screen + 4 behind rubber (shown in the video from UTi260b teardown above). Different type of C200 seem to exists - maybe yours is HiSilicon based ? A teardown would confirm that

[keenox]

Seems pretty daunting if you want to put it back again. Did you manage to put yours back together the same way it was before? I have an UTi260B on the way and wouldn't sacrifice this one until that one arrives safe and sound
Btw, mine is called A-BF RX-680, but the seller confirmed it is the same with C200

[bebopdk]

On my C200, the serial port shows up in the device manager without using this hack, but I am not able to connect to it with anything, just as you write, so perhaps the script is not executed and you just see a serial port like I do? I have attached a picture of the ID's of the C200 serial port which shows up when I connect the C200 USB to my PC.

Do we know how many FW versions there are?, my C200 is: V.1.1.10

[keenox]

Same hw id of the serial port. My firmware is 1.1.18

[Krist-win]

windows data analysis is perfect.

[optotester]

For info, last firmware version for C200 is 1.1.18.

1.1.10 is the version I had - the upgrade process only copy some hardcoded files to hardcoded paths based on the presence of "uti160e" or "IRay_C200_Thermal" files in the Upgrade folder. IRay_C200_Thermal being the app itself you won't be able to re-initiate an upgrade if you mess up with that file.
 
1.1.18 is the last one received by IRay - for info, it runs the file Upgrade/upgrade.sh when update is triggered (only if "uti160e" or "IRay_C200_Thermal" is present). The upgrade.sh file is in charge of copying the files (no more hardcoded files).

[bebopdk]

Could you please share the C200 upgrade to 1.1.18 SD card image?

[dl6lr]

I would have backed up my C200, however it does not switch on the getty with the usbdisksettings.sh upgrade nor does it backup files to the SD. It seems to do no harm either, I assume it gets never called. My unit is on version 1.1.10 too. There is no switching of USB between disk and other mode, but the executable refers to usbdisksetting.sh for the upgrade process and both /etc/rc.d/usbdisksetting.sh and /etc/rc.d/usbcamerasetting.sh. It includes the menu texts for USB disk and camera, but this is deactive in my unit. I think this is a pro enabled feature.

I noticed some flaws in their implementation:
1. It provides the disk access through USB as a static image, any pictures taken after you connected with the PC are not reflected to the PC.
2. If you unpower with USB connected, it takes very long until the USB disappears. And then you cannot switch the C200 on again. You first have to unplug the USB.

[keenox]

@optotester: Did you manage to make it run? Does it still copy the script to the internal flash and then executes? Does it get executed instantly or upon reboot?
I created a custom named file on the SD and then used find in the upgrade.sh script to find it and create a file in the same directory, but doesn't seem to get executed.

[keenox]

The UTi260B arrived today so I manned up and opened the C200/RX-680
It has an NXP MCIMX6Y2CVM08AB
I only managed to login with ftpadmin, but that can't write to the SD card. I will try to do a backup through serial alone.

U-Boot

Code: [Select]

U-Boot 2015.04 (Mar 25 2020 - 13:40:37)

CPU:   Freescale i.MX6ULL rev1.1 at 396 MHz
CPU:   Temperature 47 C
Reset cause: POR
Board: MX6UL 14x14 EVK
I2C:   ready
DRAM:  512 MiB
MMC:   FSL_SDHC: 0, FSL_SDHC: 1
*** Warning - bad CRC, using default environment

LCD st7789v init successfully!
Display: TFT28AB (240x320)
Video: Framebuffer at 0x9ef54640
240x320x16
Power-Down, charging is suspended or interrupted.
Power on.
reading logo-7.bmp
230456 bytes read in 24 ms (9.2 MiB/s)
Display-bmp: 240 x 320  with 0 colors, bpp is 24, and compression is 0
In:    serial
Out:   serial
Err:   serial
switch to partitions #0, OK
mmc1(part 0) is current device
Net:   CPU Net Initialization Failed
No ethernet found.
Normal Boot
Hit any key to stop autoboot:  0
reading boot.scr
** Unable to read file boot.scr **
mmc boot..........
reading zImage
6183072 bytes read in 151 ms (39.1 MiB/s)
Booting from mmc ...
reading imx6ul-14x14-evk.dtb
42027 bytes read in 17 ms (2.4 MiB/s)
Kernel image @ 0x80800000 [ 0x000000 - 0x5e58a0 ]
Some pics attached

[thermalengineer]

Looks good.
which is better c210 or uti260b? Is that true both of the model has 25hz frame rate?

[keenox]

Just cracked the root password (left the PC overnight). It is "uti160e". Never thought to try it 

@thermalengineer: I did not open the 260, but from what I understand so far they have the same harware. The software is better on the Uni-T (supports live usb webcam mode and has 3 movable points where it can measure).

[keenox]

Ran /etc/rc.d/usbcamerasetting.sh by hand and it works, but it only supports 15Hz. Also the live image on the cam seems to be 15Hz too.

[keenox]

@optotester: Here is the full flash backup from the C200 with 1.1.18: https://mega.nz/file/6FgyyJpb#XHXg4nk8ccflxwKWqsqqVM7w2DsnGWt9uyXsAUrCSIA

[keenox]

Also opened the UTi260B. Made a script that should activate the USB console when the update is triggered. Should work on the C200 the same.

https://www.eevblog.com/forum/thermal-imaging/uni-t-uti260b/msg4389421/#msg4389421

PS: The UTi260B application works no problems on the C200
I'm so excited! These cameras have so much potential for hacking

[fr0zzen]

https://youtu.be/uwUHPvyz5nY
Made review on C200. Bought with my own money. So far work very well.

[bebopdk]

Tried the script on my C200 V.1.1.10, and it looked like it ran(The display said "power off/reboot" after I ran it, but the USB serial port is non responding to any terminal command(the port was there before I ran the script, and was also non responsive before).

[keenox]

@bebopdk: From what I can see in the 1.1.10 firmware the upgrade is done by copying everything in the Upgrade folder, so I'm afraid you'll have to you optotester's script for that

[dl6lr]

@bebopdk: From what I can see in the 1.1.10 firmware the upgrade is done by copying everything in the Upgrade folder, so I'm afraid you'll have to you optotester's script for that

As far as I can tell: none of the scripts presented so far are working on my plain C200. Mine has Firmware 1.1.10 as to the menu. S/N C20020062533 acquired from "Guide sensmart Store" through Aliexpress on 2021, Nov 18th.

- It does not have UVC
- It does not have the selection between USB camera and disk in the menu
- It shows up with one device (see below) with three interfaces: CDC ACM and MS
- It detects files in folder Upgrade from the SD card and says you have to reboot

Upon Upgrade, in the Upgrade folder a file CalTempConfig.ini is saved.

With the usbdisksettings.sh from opto, no Backup is created, no getty is started. With Upgrade.sh no getty is started. It seems the scripts are just ignored or the getty is just not working. The CDC ACM is visible after booting the C200, but no response on commands.

Code: [Select]

bernd@debian:~$ sudo lsusb -s 2:15 -v

Bus 002 Device 015: ID 1d6b:0106 Linux Foundation Composite Gadget (ACM + MS)
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass          239 Miscellaneous Device
  bDeviceSubClass         2
  bDeviceProtocol         1 Interface Association
  bMaxPacketSize0        64
  idVendor           0x1d6b Linux Foundation
  idProduct          0x0106
  bcdDevice            3.14
  iManufacturer           3 Linux 3.14.38-6UL_ga with 2184000.usb
  iProduct                4 Composite Gadget (ACM + MS)
  iSerial                 0
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength       0x0062
    bNumInterfaces          3
    bConfigurationValue     1
    iConfiguration          0
    bmAttributes         0xc0
      Self Powered
    MaxPower                2mA
    Interface Association:
      bLength                 8
      bDescriptorType        11
      bFirstInterface         0
      bInterfaceCount         2
      bFunctionClass          2 Communications
      bFunctionSubClass       2 Abstract (modem)
      bFunctionProtocol       1 AT-commands (v.25ter)
      iFunction               8 CDC Serial
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           1
      bInterfaceClass         2 Communications
      bInterfaceSubClass      2 Abstract (modem)
      bInterfaceProtocol      1 AT-commands (v.25ter)
      iInterface              6 CDC Abstract Control Model (ACM)
      CDC Header:
        bcdCDC               1.10
      CDC Call Management:
        bmCapabilities       0x00
        bDataInterface          1
      CDC ACM:
        bmCapabilities       0x02
          line coding and serial state
      CDC Union:
        bMasterInterface        0
        bSlaveInterface         1
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            3
          Transfer Type            Interrupt
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x000a  1x 10 bytes
        bInterval               9
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        1
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass        10 CDC Data
      bInterfaceSubClass      0
      bInterfaceProtocol      0
      iInterface              7 CDC ACM Data
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        2
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         8 Mass Storage
      bInterfaceSubClass      6 SCSI
      bInterfaceProtocol     80 Bulk-Only
      iInterface              1 Mass Storage
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x83  EP 3 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x02  EP 2 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               1
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass          239 Miscellaneous Device
  bDeviceSubClass         2
  bDeviceProtocol         1 Interface Association
  bMaxPacketSize0        64
  bNumConfigurations      1
can't get debug descriptor: Resource temporarily unavailable
Device Status:     0x0001
  Self Powered


[keenox]

The only 1.1.10 app that I have is from optotester and that has usb camera mode and copies files from the upgrade directory onto the internal flash.
The 1.1.18 app that came on my C200 has no usb mode switch option visible although the menu is present in the app code. This one runs the upgrade.sh script.
The 1.2.6 firmware from my UTi260B has the menu and an extra 3 custom measurement points menu. This one also runs the upgrade.sh script on update.

I could provide the 1.1.18 app and you can put it in the upgrade folder on your sd so it will update, but that will make your original app unrecoverable.
The best option would be to disassemble the camera and connect to the serial port on the PCB and then dd/copy the firmware to the SD card, activate the terminal on USB and then put it back together. That would be the safest option to preserve your original firmware and would benefit us more knowledge on the existing firmwares.

PS: Did you unzip the whole folder including the uti160e file?

[dl6lr]

The only 1.1.10 app that I have is from optotester and that has usb camera mode and copies files from the upgrade directory onto the internal flash.
The 1.1.18 app that came on my C200 has no usb mode switch option visible although the menu is present in the app code. This one runs the upgrade.sh script.
The 1.2.6 firmware from my UTi260B has the menu and an extra 3 custom measurement points menu. This one also runs the upgrade.sh script on update.

I could provide the 1.1.18 app and you can put it in the upgrade folder on your sd so it will update, but that will make your original app unrecoverable.
The best option would be to disassemble the camera and connect to the serial port on the PCB and then dd/copy the firmware to the SD card, activate the terminal on USB and then put it back together. That would be the safest option to preserve your original firmware and would benefit us more knowledge on the existing firmwares.

PS: Did you unzip the whole folder including the uti160e file?

OK, so you flashed the files from optotester to your device to confirm the usb camera?  I already have the 1.1.18 file from your camera as you provided a raw flash backup. I can mount the image file with both partitions and I looked around. Will have to disassemble mine, take a backup and compare with the image from optotester. I found /etc/UTi160E_config.ini to contain a line stating usb mode is "usbcamera" which is not true on your device. And in /root the file UTi160E_config.ini is empty, that is where the IRay_C200_Thermal executable is located. For the confusing file names, it seems that Infiray developed the camera core but the whole device including software seems to be developed by or at least for UniT? Then they branded it InfiRay again?

Currently comparing UTi and IRay, there are a lot of differences in the file system...

[keenox]

Did not flash it. Only copied his IRay_C200_Thermal executable where mine is and restarted the camera and it worked no problems.
Currently the /root/UTi160E_config.ini is not empty, but that might be because I played around with different apps.
That usbmode seems to be completely ignored by the 1.1.18 app that arrived on my A-BF camera. I disassembled it using ghidra, but didn't have time to understand everything that happens. The menus are there and are instantiated, but don't appear. There are also some menus for video recording and viewing and wifi(but the drivers are still on the flash, maybe used only on the proto/dev board?), but haven't seen those on any camera.

I think it might have been a commissioned project for Uni-T from the start and they decided they will also sell it under their own brand (and others, like mine which is A-BF). That's my guess, since uti160e is referenced in a lot of places.

[dl6lr]

Did not flash it. Only copied his IRay_C200_Thermal executable where mine is and restarted the camera and it worked no problems.

So you copied the executable from 1.1.10 to your C200 with 1.1.18 (from getty I suppose, or did you go the SD card upgrade path?) and that worked with usb mode menu and UVC mode without changing anything else? So maybe it is just compiled into the executable then.

I compared the init scripts and the difference is, the uvc drivers are loaded in /etc/rc.d/apps.sh (in the 1.1.10 files that opto provided) which is referenced from /etc/rc.d/rc.local. I assumed that the same executable was used for both cameras, C200 and C200pro, with only some configuration changes. On my camera the /etc/rc.d/usbdisksetting.sh never gets executed or it is never overwritten during the upgrade. The scripts name is only contained in Iray_C200_Thermal executable.

Will disassemble my camera one day and try to back it up from the terminal then.