Products > Thermal Imaging

Unbricking FLIR T620

(1/3) > >>

BiD:
I had purchased a damaged FLIR T620 that has a broken screen and didn't seem to boot.  I've tried using the update tool however it doesn't seem to retain the update, once I reboot I can see via that the /FlashFS directory that gets created after the update disappears.  I made a quick video of some of it:



I was wondering if anyone happen to have some ideas as to why the flash update isn't being retained?  I know there was effort to revert the firmware to older firmware on the FLIR E40, I read through a lot of the E40-related thread and if they had ran into the same problem.


I was able to capture the authentication to the FTP using Wireshark:

User: anonymous
Password: NcFTP@

however maybe the privilege of "anonymous" isn't sufficient to see and write to the real root directory and it's writing to a "chroot"-like root, this would explain why the update isn't taking and the system reverts when it reboots.

I was able to figure out the pinouts on the 12-pin receptacle that's seen in many FLIR boards. 

12-pin connector:
    Digi-Key Part Number: ( 1195-3392-1-ND )
    Connector Manufacturer: HARTING
    Connector Manufacturer Part Number: 15210122601000

26-pin connector:
    Digi-Key Part Number: ( 1195-3395-1-ND )
    Connector Manufacturer: HARTING
    Connector Manufacturer Part Number: 15210262601000


I'm working through the 26-pin receptacle that's also common on FLIR boards and will update.

Open to ideas!  Thanks!

** Update 2020-06-27:
* Found some I2C in 26-pin receptacle, added photo and decoded I2C output.
* Attached UART output in uart_output.20200627.1.txt for reference

What was happening was when I ran the upgrade, it was installing the files into /FlashFS/ however it was creating that directory.  That directory *should* of existed prior to the install.  I had issued the cmd `diskutil -L` and saw:


--- Code: ---Store "Intel Virtual File System":
Device Name: "DSK1:"
Description.: Intel Virtual File System
Partitions: 0
Mount Count: 0
Device Type: FLASH
Device Flags: |STORAGE_DEVICE_FLAG_READWRITE|
Device Attributes: |AUTOFORMAT|
Number of Sectors: 216513
Bytes per Sector: 512
Free Sectors: 0
Biggest Partition Creatable (sectors): 0
No partitions found on "DSK1:"!

--- End code ---

so basically the partition somehow is corrputed.  I preformed a low-level format using `diskutil`


--- Code: ----F <s> -l               Low-level format store
--- End code ---

then created a partition on DSK1 with the size of the whole device:


--- Code: ---diskutil -C DSK1: -p Part00 -x 216510
--- End code ---

and now I see this `diskutil -L`



--- Code: ---Received shell command message:
Store "Intel Virtual File System":
Device Name: "DSK1:"
Description.: Intel Virtual File System
Partitions: 1
Mount Count: 1
Device Type: FLASH
Device Flags: |STORAGE_DEVICE_FLAG_READWRITE|
Device Attributes:
Number of Sectors: 216513
Bytes per Sector: 512
Free Sectors: 0
Biggest Partition Creatable (sectors): 0

Partiton "Part00" on "DSK1:":
Partition Name: "Part00"
File System: exfat.dll
Volume Name: FlashFS
Volume Attributes: Volume Flags: |TRANSACTION_SAFE|WFSC_SUPPORTED|LOCKFILE_SUPPORTED|STORE|
Number of Sectors: 216510
Partition Type: DOS4_FAT (FAT16)
Partition Attributes: |MOUNTED|


--- End code ---

and when I list directory, I get:


--- Code: --- Directory of \

01/01/1998    04:00a    <DIR>          StorageCard
01/01/1998    04:00a    <DIR>          FlashFS
01/08/2010    07:17p             4,096 Printer.swap
01/08/2010    11:17a    <DIR>          profiles
01/08/2010    11:17a    <DIR>          Documents and Settings
01/08/2010    11:17a    <DIR>          My Documents
01/08/2010    11:17a    <DIR>          Program Files
01/08/2010    11:17a    <DIR>          Temp
01/08/2010    11:17a    <DIR>          Windows
               1 File(s)         4,096 bytes
               8 Dir(s)     50,008,064 bytes free



--- End code ---

Device now boots up fine however looks like calibration data is missing.  In UART logs "uart_output-afterflash.20200627.1.txt" :


--- Code: ---Exception 'Raised Exception' (-1): Thread-Id=066e0032(pth=90a8b33c), Proc-Id=0705000a(pprc=903b23a0) 'uicore.exe', VM-active=075000a(pprc=903b23a0) 'uicore.exe'
PC=400608c4(coredll.dll+0x000508c4) RA=883ba2c0(kernel.dll+0x000062c0) SP=0032dd34, BVA=0032ddfc
uicore: 1263010518:964: Info: Cascades version: 3.8.13
uicore: 1263010520:610: Error: FLIR::modules::SystemInfo::UpdateLensInfo: Failed to read calibration resource: FLIR::core_interace::ResourceManager::OpenResource: Failed to open resource: .calib.lens.le.isMeasured, return code: 0xab010004
Exception 'Raised Exception' (-1): Thread-Id=066e0032(pth=90a8b33c), Proc-Id=0705000a(pprc=903b23a0) 'uicore.exe', VM-active=075000a(pprc=903b23a0) 'uicore.exe'
PC=400608c4(coredll.dll+0x000508c4) RA=883ba2c0(kernel.dll+0x000062c0) SP=0032e490, BVA=0032e558
uicore: 1263010521:168: Error: FLIR::modules::ImageOps::OpenResources: Zoom disabled.
Exception 'Raised Exception' (-1): Thread-Id=066e0032(pth=90a8b33c), Proc-Id=0705000a(pprc=903b23a0) 'uicore.exe', VM-active=075000a(pprc=903b23a0) 'uicore.exe'
PC=400608c4(coredll.dll+0x000508c4) RA=883ba2c0(kernel.dll+0x000062c0) SP=0032e714, BVA=0032e7d8
POST 20100108 20:15:21 -       uicore.exe: pdfReader tid 0x065F0236 qid 82
Exception 'Raised Exception' (-1): Thread-Id=066e0032(pth=90a8b33c), Proc-Id=0705000a(pprc=903b23a0) 'uicore.exe', VM-active=075000a(pprc=903b23a0) 'uicore.exe'
PC=400608c4(coredll.dll+0x000508c4) RA=883ba2c0(kernel.dll+0x000062c0) SP=0032e9c8, BVA=0032ea90
uicore: 1263010521:881: Error: FLIR::modules::VoiceAnnotation::OpenResources: Couldnt open resources for VoiceAnnotation; IGNORNG during dev
POST 20100108 20:15:21 -       uicore.exe: Created modules in 2431 ms
CamAppThread: 256 buffers, 21 Hz


--- End code ---


** Update 2020-07-04:
I was able to get it working!  The fixed required the missing files


--- Code: ---Flashfs/system/calib.rsc
Flashfs/system/appcore.d/config.d/conf.cfg
Flashfs/system/maps/*
Flashfs/system/appcore.d/*

--- End code ---

The *.rsc required updating of the serial number and CRC value.

The unit boots up fine and shows the imager's image .  Since the map files were from another unit, it's not calibrated to this unit and there's dead pixels that's not compensated for.  Next bit is to figure out where that information stored.

It's worth noting that the UART/JTAG socket is accessible behind the sticker in the battery shroud, see IMG_6120.jpeg.

H/T to Chanc3 for helping me on this. 

agiorgitis:
Just couple of ideas:
-Try filezilla with fliruser:3vlig like in Ex
-Since it doesn't recognize the lens, try to boot without it (if the camera fell and broke the screen, maybe lens chip got destroyed too)
-Try different firmware versions (older ones) if you can find online
-maybe the screen's touch surface is shortcircuited and when you boot it's like pressing many times the screen and hangs?
-Is there an internal battery that you can replace?

BiD:
agiorgitis,

Thanks for the suggestions

> -Try filezilla with fliruser:3vlig like in Ex

Yes, I initially tried that and it didn't work and ended up using Wireshark to capture the credential mentioned in OP

> -Since it doesn't recognize the lens, try to boot without it (if the camera fell and broke the screen, maybe lens chip got destroyed too)

Just tried, it did not seem to make a difference.

> -Try different firmware versions (older ones) if you can find online

I'll see if I can dig up anything.

> -maybe the screen's touch surface is shortcircuited and when you boot it's like pressing many times the screen and hangs?

I've tried removing it and I just get additional error shown in UART and doesnt seem to make any differences in booting.

> -Is there an internal battery that you can replace?

Yes, I've checked its voltage and it seems okay.


Attached UART output in OP uart_output.20200627.1.txt , some of the peripheral errors I think are okay because I don't have those things plugged in.  Most of them go away when I reassemble however it still doesn't boot just with I2C related messages going away.

railrun:
Have you tried different key combinations? When you start the camera keep the joystick down(Or up/left/right) for example?
On the E40 you can then login via ftp without username/password.

BiD:
> Have you tried different key combinations? When you start the camera keep the joystick down(Or up/left/right) for example?

I have not, I'll try that although there's a lot of possible key combinations.  For E40, was it single-key combination?

Navigation

[0] Message Index

[#] Next page

There was an error while thanking
Thanking...
Go to full version
Powered by SMFPacks Advanced Attachments Uploader Mod