Vevor SC240N / TopDon TC004 / InfiRay C200 / Hisilicon HI3516DV300

[Manawyrm]

Hey,

after a recent video by Marco Reps, I grabbed one of those cheap InfiRay cameras.


They boot Linux on a Hisilicon SoC, which makes them a bit of an interesting target for tinkering.

I got the SC240N-variant, without the visible-light camera (and thus without video recording capability).
This camera also doesn't support USB/UVC webcam, although the seemingly identical TC004 does.

Marco has a teardown at the end of the video, so no real need for pictures here, I think.
First observations:
Serial port on the board, J16.
Actual RS232 levels, not a UART! With negative voltages, inverted signal level and everything!

Code: [Select]

1 gnd
2 tx
3 rx
4 ??? probably also gnd
5 ???
6 ???
Bootlog is attached.
U-Boot can be aborted and has a shell (pretty fully featured).

Parts of the env:

Code: [Select]

bootargs=mem=256M console=ttyAMA0,115200 root=/dev/mmcblk0p3 rw rootfstype=ext4 rootwait blkdevparts=mmcblk0:1M(boot),4M(kernel),150M(rootfs)
bootcmd=mmc read 0x0 0x81000000 0x800 0x2000;mmc read 0x0 0x82000000 0x680 0x80;mmc read 0 0xb8300000 0x700 0x80;mmc read 0 0x83000000 0x780 0x80;decjpg 0;startvo 0 2048 42;startvl 0 0xb8100000 256 0 0 240 320;bootm 0x81000000
soc=hi3516dv300
stderr=serial

Let's dump the firmware before we break anything. We sadly can't do the same trick with uboot as optotester did for his i.MX-based imagers, so let's boot into Linux and use dd:

Code: [Select]

setenv bootargs init=/bin/sh mem=256M console=ttyAMA0,115200 root=/dev/mmcblk0p3 rw rootfstype=ext4 rootwait blkdevparts=mmcblk0:1M(boot),4M(kernel),150M(rootfs)
boot(same bootargs, just with init=/bin/sh)
this drops us into a shell.

I copied the firmware using

Code: [Select]

dd if=/dev/mmcblk0 of=/dev/mmcblk1 bs=8Mto the SD card (this wipes the SD card of course).

So, what can we learn for now?
- Linux 4.9.37
- Hisilicon HI3516DV300
- u-boot doesn't have SD support, only eMMC (or the device tree is misconfigured, etc. mmc list only shows the eMMC)
- 8 GiB eMMC, 256 MiB DRAM
- stock kernel has r8152, usb-storage and WiFi modules (8189fs.ko SDIO).
- lighttpd (webserver!) installed
- ext4 root FS is mounted read/write in operation. There's a good chance this device will kill itself over time with this.
- hostapd, etc. is also installed, maybe there's a chance to get this thing using network or even WiFi with USB-OTG.

So far I haven't seen a way "in" yet, without using a RS232 serial.

Cracked the root-Password:

Code: [Select]

0SV1EYeeHloi.:iraytek                                     

Used the u-boot/bootargs trick again to edit the /etc/inittab with vi and added:

Code: [Select]

::respawn:/sbin/getty 115200 ttyAMA0
and was then greeted by a root shell:

 

[Fraser]

Interesting work. Thanks 

Fraser

[nsa666]

Adding Video-Recording and UVC would be great. Can you launch another control app from sd?

[Manawyrm]

Boot process
Some notes about the boot process, it starts with /etc/init.d, running all the scripts there.
The first really interesting one is /etc/init.d/S90start:

loads  /iray_app/huamian (seems to be some kind of JPEG decoder)
loads a bunch of kernel modules
optionally configures the USB UVC webcam mode

then runs /hisi_ko/load3516dv300 (bash script), which loads a bunch more kernel modules.
on my camera (without visible light camera), the commandline

Code: [Select]

./load3516dv300 -i -senor0 gc2145 -sensor1 rtd2121w -osmem 256 -yuv0 3 is used.
Notice the typo in "-senor0" at the visible light camera. Very strange.

It will then run /iray_app/iray-hisi-camera (in the background), which is the actual QT camera application.

UVC webcam mode
I have enabled

Code: [Select]

export uvc_sd=1 on my camera, which actually leads to a UVC device being enumerated.
Unfortunately, connecting to it using OBS, VLC, etc. will result in a single frame of video and then stops.

I have played around with the YUV, MJPEG and H264 settings, buffer sizes, etc. but nothing changes the behaviour.

Code: [Select]

/iray_app/uvc_app.conf also has a bunch of configuration parameters related to the webcam mode, but again, wasn't able to get a properly working config there.

Camera settings / video recording
The camera seems to store it's settings in

Code: [Select]

/iray_ko/iray_m.ini, which has a bunch of the user-defined configuration parameters (like the palettes, image auto-save, emissivity, etc.).
Sadly, I didn't yet find the flag responsible for allowing video recording.

Kernel hacking
I've also extracted the device-tree from /proc/device-tree (just to take a look at settings like the USB dwc3 mode, which is currently set to peripheral), so no easy way to connect USB devices (like a WiFi dongle or NIC) to the USB-C port.

I chroot'ed into a ArchLinux ARM userland on an SD card:



I found the repo https://github.com/cijliu/linux, which is the same 4.9.37 kernel used on the camera, with the fitting HiSilicon board support.
After fixing some -fcommon bugs (due to my modern host toolchain), I was able to compile that kernel using https://releases.linaro.org/components/toolchain/binaries/6.3-2017.05/arm-linux-gnueabi/ .
I wasn't able to boot my custom kernel (most likely due to differences in the device tree or configs), but I was able to load modules from my kernel, which is very nice:

Code: [Select]

insmod u_ether.ko
insmod u_serial.ko
insmod usb_f_acm.ko
insmod usb_f_ecm.ko
insmod usb_f_ecm_subset.ko
insmod usb_f_mass_storage.ko
insmod usb_f_obex.ko
insmod usb_f_rndis.ko
insmod usb_f_serial.ko
insmod usb_f_uvc.ko

mount -t configfs none /sys/kernel/config/

CONFIGFS_HOME=/sys/kernel/config

GADGET_NAME="l4t"
VID="0x0955"
PID="0x7020"
SERIAL="no-serial"
MANUF="RR"
PRODUCT="RR gadget"

mkdir -p "$CONFIGFS_HOME/usb_gadget/$GADGET_NAME"
cd "$CONFIGFS_HOME/usb_gadget/$GADGET_NAME"
echo "$VID" > idVendor
echo "$PID" > idProduct

mkdir strings/0x409
echo "$SERIAL" > strings/0x409/serialnumber
echo "$MANUF" > strings/0x409/manufacturer
echo "$PRODUCT" > strings/0x409/product
CFG="c.1"
CFG_STR="ECM"
mkdir -p "configs/$CFG"

FUNC_NAME="ecm"
INSTANCE_NAME="usb0"
FUNC="functions/$FUNC_NAME.$INSTANCE_NAME"
mkdir -p "$FUNC"
mac_ecm_h="7a:68:46:2f:bd:aa"
mac_ecm_d="7a:68:46:2f:bd:ab"
echo "$mac_ecm_h" > "$FUNC/host_addr"
echo "$mac_ecm_d" > "$FUNC/dev_addr"
ln -sf "$FUNC" "configs/$CFG"
mkdir -p "configs/$CFG/strings/0x409"
echo "$CFG_STR" > "configs/$CFG/strings/0x409/configuration"
UDC_DEV=`ls /sys/class/udc`
echo "$UDC_DEV" > UDC

ip link set usb0 up
ip addr add 172.16.0.2/24 dev usb0
ip route add 0.0.0.0/0 via 172.16.0.1
echo "nameserver 8.8.8.8" > /etc/resolv.conf

and then we expose a new usb0 network interface over to the computer and we have internet connectivity on the camera (provided that the attached computer does NAT/routing).

I was able to start the (already installed) lighttpd webserver, there's a start script for it in /iray_sh/http.sh, but it also tries to setup WiFi and stuff.
I ran

Code: [Select]

lighttpd -f   /lighthttp/config/lighttpd.conf:

(this exposes the partition with all the images on the SD card, pretty useful)

Modding the device tree and either adding an SDIO card with a WiFi chipset or switching the USB dwc3 controller mode to host would probably allow us to have network connectivity permanently, which would be very nice.

Framebuffer

Someone mentioned DOOM, so I've had a quick look, /dev/fb0 seems to be magically overlayed/mixed with the hardware video signal.
It contains RGBA8888 data and the alpha channel is actually used. I dumped /dev/fb0 into a file and opened it using GIMP:

So the fb0 just contains the overlay/GUI, no video data for us to extract sadly.

Modding without the serial port
I was actively looking for some backdoor / other method of getting into the device without soldering a RS232 serial to it.
Sadly, so far I didn't find anything super simple in any of the scripts.
One of the binaries (ELF/Linux/armv7) contains references to an update .zip file and has some paths related to that.
My binary reverse engineering skills aren't sufficient to try and understand how to give it a useful "update", I think, but there might be a way in.

[Manawyrm]

Can you launch another control app from sd?

You can do pretty much anything, yes. Not sure how/where you'd find a compatible control app to run on this device, though.
Getting a firmware dump from a SC240M (with video recording, etc.) would probably be pretty interesting, but they're out of stock unfortunately.

[nsa666]

There: https://www.eevblog.com/forum/thermal-imaging/infiray-c210-thermal-camera-review/msg4368193/#msg4368193
is a dump of  Infiray C200 Firmware. Dont know if it helps.

[IanJ]

I got the SC240N-variant, without the visible-light camera (and thus without video recording capability).
This camera also doesn't support USB/UVC webcam, although the seemingly identical TC004 does.

From the spec on the web:
Vevor SC240N = 240x180
Topdon TC004 = 256x192

Would be interesting to see a direct comparison if somebody has both.

Ian.

[Manawyrm]

Would be interesting to see a direct comparison if somebody has both.

Ack.
But interestingly enough, everything on the SC240N's firmware also references 256x192:

Code: [Select]

[settings]
Camera=105
Picture_h=192
Picture_w=256

Not sure if 240x180 is the usable area of the chip or something like that (and Vevor being sold in the EU don't want to break advertising laws), but they really seem to have identical sensors & specs.

[Manawyrm]

Oh...

OK, well, that's a working UVC webcam

Turns out: Their implementation seems to behave buggy against a Linux 6.3 host.
With Windows (both OBS and the native Windows 11 camera app) it works immediately.

macOS just kernel panic's the camera alltogether, which is very fun 

Seeing this, I've enabled UVC tracing on my Linux machine:

Code: [Select]

echo 0xffff > /sys/module/uvcvideo/parameters/trace
which results in the following log output (in YUV mode):

Code: [Select]

[26524.076642] usb 1-1: Dropping payload (out of sync)
[26524.076644] usb 1-1: Dropping payload (out of sync)
[26524.076646] usb 1-1: Dropping payload (out of sync)
[26524.076648] usb 1-1: Dropping payload (out of sync)
[26524.076650] usb 1-1: Dropping payload (out of sync)
[26524.076653] usb 1-1: Dropping payload (out of sync)
[26524.080584] usb 1-1: Dropping payload (out of sync)
[26524.080589] usb 1-1: Dropping payload (out of sync)
[26524.080591] usb 1-1: frame 2 stats: 0/451/451 packets, 0/0/0 pts (!early !initial), 0/0 scr, last pts/stc/sof 0/0/0
[26524.083365] usb 1-1: uvc_v4l2_poll
[26524.114524] usb 1-1: Device requested 3072 B/frame bandwidth
[26524.114528] usb 1-1: Selecting alternate setting 1 (3072 B/frame bandwidth)
[26524.467629] usb 1-1: Allocated 5 URB buffers of 32x3072 bytes each
[26524.467680] usb 1-1: uvc_v4l2_poll
[26524.471630] usb 1-1: Frame complete (EOF found)
[26524.471632] usb 1-1: frame 1 stats: 0/29/29 packets, 0/0/0 pts (!early !initial), 0/0 scr, last pts/stc/sof 0/0/0
[26524.499631] usb 1-1: Frame complete (overflow)
[26524.499637] usb 1-1: Dropping payload (out of sync)
[26524.499639] usb 1-1: Dropping payload (out of sync)
[26524.499643] usb 1-1: Dropping payload (out of sync)
[26524.499645] usb 1-1: Dropping payload (out of sync)
[26524.499647] usb 1-1: Dropping payload (out of sync)
[26524.499649] usb 1-1: Dropping payload (out of sync)
[26524.499652] usb 1-1: Dropping payload (out of sync)
[26524.499654] usb 1-1: Dropping payload (out of sync)
[26524.499656] usb 1-1: Dropping payload (out of sync)
[26524.499659] usb 1-1: Dropping payload (out of sync)
[26524.499661] usb 1-1: Dropping payload (out of sync)
[26524.499663] usb 1-1: Dropping payload (out of sync)
[26524.499665] usb 1-1: Dropping payload (out of sync)
[26524.499667] usb 1-1: Dropping payload (out of sync)
[26524.499669] usb 1-1: Dropping payload (out of sync)
[26524.499672] usb 1-1: Dropping payload (out of sync)
[26524.499674] usb 1-1: Dropping payload (out of sync)
[26524.499676] usb 1-1: Dropping payload (out of sync)
[26524.499679] usb 1-1: Dropping payload (out of sync)
[26524.499681] usb 1-1: Dropping payload (out of sync)
[26524.499683] usb 1-1: Dropping payload (out of sync)
[26524.499685] usb 1-1: Dropping payload (out of sync)
[26524.499687] usb 1-1: Dropping payload (out of sync)
[26524.499689] usb 1-1: Dropping payload (out of sync)
[26524.503629] usb 1-1: Dropping payload (out of sync)
[26524.503633] usb 1-1: Dropping payload (out of sync)
[26524.503636] usb 1-1: Dropping payload (out of sync)
[26524.503639] usb 1-1: Dropping payload (out of sync)
[26524.503642] usb 1-1: Dropping payload (out of sync)
[26524.503644] usb 1-1: Dropping payload (out of sync)
[26524.503646] usb 1-1: Dropping payload (out of sync)
[26524.503649] usb 1-1: Dropping payload (out of sync)
[26524.503651] usb 1-1: Dropping payload (out of sync)
[26524.503653] usb 1-1: Dropping payload (out of sync)
[26524.503655] usb 1-1: Dropping payload (out of sync)
[26524.503657] usb 1-1: Dropping payload (out of sync)
[26524.503660] usb 1-1: Dropping payload (out of sync)
[26524.503662] usb 1-1: Dropping payload (out of sync)
[26524.503664] usb 1-1: Dropping payload (out of sync)
[26524.503666] usb 1-1: Dropping payload (out of sync)
[26524.503668] usb 1-1: Dropping payload (out of sync)
[26524.503670] usb 1-1: Dropping payload (out of sync)
[26524.503672] usb 1-1: Dropping payload (out of sync)
[26524.503674] usb 1-1: Dropping payload (out of sync)
[26524.503677] usb 1-1: Dropping payload (out of sync)
[26524.503679] usb 1-1: Dropping payload (out of sync)
[26524.503681] usb 1-1: Dropping payload (out of sync)
[26524.503683] usb 1-1: Dropping payload (out of sync)
[26524.503685] usb 1-1: Dropping payload (out of sync)
[26524.503687] usb 1-1: Dropping payload (out of sync)
[26524.503690] usb 1-1: Dropping payload (out of sync)
[26524.503692] usb 1-1: Dropping payload (out of sync)
[26524.503694] usb 1-1: Dropping payload (out of sync)
[26524.503696] usb 1-1: Dropping payload (out of sync)
[26524.503698] usb 1-1: Dropping payload (out of sync)
[26524.503700] usb 1-1: Dropping payload (out of sync)
[26524.507631] usb 1-1: Dropping payload (out of sync)
[26524.507636] usb 1-1: Dropping payload (out of sync)
[26524.507638] usb 1-1: Dropping payload (out of sync)
[26524.507642] usb 1-1: Dropping payload (out of sync)
[26524.507644] usb 1-1: Dropping payload (out of sync)
[26524.507646] usb 1-1: Dropping payload (out of sync)
[26524.507649] usb 1-1: Dropping payload (out of sync)
[26524.507651] usb 1-1: Dropping payload (out of sync)
[26524.507653] usb 1-1: Dropping payload (out of sync)
[26524.507656] usb 1-1: Dropping payload (out of sync)
[26524.507658] usb 1-1: Dropping payload (out of sync)
[26524.507660] usb 1-1: Dropping payload (out of sync)
[26524.507663] usb 1-1: Dropping payload (out of sync)
[26524.507665] usb 1-1: Dropping payload (out of sync)
[26524.507667] usb 1-1: Dropping payload (out of sync)
[26524.507669] usb 1-1: Dropping payload (out of sync)
[26524.507672] usb 1-1: Dropping payload (out of sync)
[26524.507674] usb 1-1: Dropping payload (out of sync)
[26524.507676] usb 1-1: Dropping payload (out of sync)
[26524.507679] usb 1-1: Dropping payload (out of sync)
[26524.507681] usb 1-1: Dropping payload (out of sync)
[26524.507683] usb 1-1: Dropping payload (out of sync)
[26524.507685] usb 1-1: Dropping payload (out of sync)
[26524.507688] usb 1-1: Dropping payload (out of sync)
[26524.507690] usb 1-1: Dropping payload (out of sync)
[26524.507692] usb 1-1: Dropping payload (out of sync)
[26524.507694] usb 1-1: Dropping payload (out of sync)
[26524.507696] usb 1-1: Dropping payload (out of sync)
[26524.507699] usb 1-1: Dropping payload (out of sync)
[26524.507701] usb 1-1: Dropping payload (out of sync)
[26524.507703] usb 1-1: Dropping payload (out of sync)
[26524.507705] usb 1-1: Dropping payload (out of sync)
[26524.511632] usb 1-1: Dropping payload (out of sync)
[26524.511636] usb 1-1: Dropping payload (out of sync)
[26524.511638] usb 1-1: Dropping payload (out of sync)
[26524.511642] usb 1-1: Dropping payload (out of sync)
[26524.511644] usb 1-1: Dropping payload (out of sync)
[26524.511646] usb 1-1: Dropping payload (out of sync)
[26524.511649] usb 1-1: Dropping payload (out of sync)
[26524.511651] usb 1-1: Dropping payload (out of sync)
[26524.511653] usb 1-1: Dropping payload (out of sync)
[26524.511656] usb 1-1: Dropping payload (out of sync)
[26524.511658] usb 1-1: Dropping payload (out of sync)
[26524.511660] usb 1-1: Dropping payload (out of sync)
[26524.511662] usb 1-1: Dropping payload (out of sync)
[26524.511664] usb 1-1: Dropping payload (out of sync)
[26524.511667] usb 1-1: Dropping payload (out of sync)
[26524.511669] usb 1-1: Dropping payload (out of sync)
[26524.511671] usb 1-1: Dropping payload (out of sync)
[26524.511674] usb 1-1: Dropping payload (out of sync)
[26524.511676] usb 1-1: Dropping payload (out of sync)
[26524.511678] usb 1-1: Dropping payload (out of sync)
[26524.511680] usb 1-1: Dropping payload (out of sync)
[26524.511682] usb 1-1: Dropping payload (out of sync)
[26524.511684] usb 1-1: Dropping payload (out of sync)
[26524.511686] usb 1-1: Dropping payload (out of sync)
[26524.511689] usb 1-1: Dropping payload (out of sync)
[26524.511691] usb 1-1: Dropping payload (out of sync)
[26524.511693] usb 1-1: Dropping payload (out of sync)
[26524.511695] usb 1-1: Dropping payload (out of sync)
[26524.511697] usb 1-1: Dropping payload (out of sync)
[26524.511700] usb 1-1: Dropping payload (out of sync)
[26524.511702] usb 1-1: Dropping payload (out of sync)
[26524.511704] usb 1-1: Dropping payload (out of sync)
[26524.515630] usb 1-1: Dropping payload (out of sync)
[26524.515635] usb 1-1: Dropping payload (out of sync)
[26524.515637] usb 1-1: Dropping payload (out of sync)
[26524.515640] usb 1-1: Dropping payload (out of sync)
[26524.515643] usb 1-1: Dropping payload (out of sync)
[26524.515645] usb 1-1: Dropping payload (out of sync)
[26524.515647] usb 1-1: Dropping payload (out of sync)
[26524.515649] usb 1-1: Dropping payload (out of sync)
[26524.515651] usb 1-1: Dropping payload (out of sync)
[26524.515653] usb 1-1: Dropping payload (out of sync)
[26524.515656] usb 1-1: Dropping payload (out of sync)
[26524.515658] usb 1-1: Dropping payload (out of sync)
[26524.515660] usb 1-1: Dropping payload (out of sync)
[26524.515662] usb 1-1: Dropping payload (out of sync)
[26524.515664] usb 1-1: Dropping payload (out of sync)
[26524.515666] usb 1-1: Dropping payload (out of sync)
[26524.515668] usb 1-1: Dropping payload (out of sync)
[26524.515671] usb 1-1: Dropping payload (out of sync)
[26524.515673] usb 1-1: Dropping payload (out of sync)
[26524.515675] usb 1-1: Dropping payload (out of sync)
[26524.515677] usb 1-1: Dropping payload (out of sync)
[26524.515679] usb 1-1: Dropping payload (out of sync)
[26524.515681] usb 1-1: Dropping payload (out of sync)
[26524.515683] usb 1-1: Dropping payload (out of sync)
[26524.515685] usb 1-1: Dropping payload (out of sync)
[26524.515688] usb 1-1: Dropping payload (out of sync)
[26524.515690] usb 1-1: Dropping payload (out of sync)
[26524.515692] usb 1-1: Dropping payload (out of sync)
[26524.515694] usb 1-1: Dropping payload (out of sync)
[26524.515696] usb 1-1: Dropping payload (out of sync)
[26524.515698] usb 1-1: Dropping payload (out of sync)
[26524.515701] usb 1-1: Dropping payload (out of sync)
[26524.519633] usb 1-1: Dropping payload (out of sync)
[26524.519637] usb 1-1: Dropping payload (out of sync)
[26524.519640] usb 1-1: Dropping payload (out of sync)
[26524.519644] usb 1-1: Dropping payload (out of sync)
[26524.519646] usb 1-1: Dropping payload (out of sync)
[26524.519648] usb 1-1: Dropping payload (out of sync)
[26524.519650] usb 1-1: Dropping payload (out of sync)
[26524.519652] usb 1-1: Dropping payload (out of sync)
[26524.519654] usb 1-1: Dropping payload (out of sync)
[26524.519657] usb 1-1: Dropping payload (out of sync)
[26524.519659] usb 1-1: Dropping payload (out of sync)
[26524.519661] usb 1-1: Dropping payload (out of sync)
[26524.519663] usb 1-1: Dropping payload (out of sync)
[26524.519666] usb 1-1: Dropping payload (out of sync)
[26524.519668] usb 1-1: Dropping payload (out of sync)
[26524.519670] usb 1-1: Dropping payload (out of sync)
[26524.519672] usb 1-1: Dropping payload (out of sync)
[26524.519674] usb 1-1: Dropping payload (out of sync)
[26524.519676] usb 1-1: Dropping payload (out of sync)
[26524.519678] usb 1-1: Dropping payload (out of sync)
[26524.519680] usb 1-1: Dropping payload (out of sync)
[26524.519682] usb 1-1: Dropping payload (out of sync)
[26524.519685] usb 1-1: Dropping payload (out of sync)
[26524.519687] usb 1-1: Dropping payload (out of sync)
[26524.519689] usb 1-1: Dropping payload (out of sync)
[26524.519691] usb 1-1: Dropping payload (out of sync)
[26524.519693] usb 1-1: Dropping payload (out of sync)
[26524.519695] usb 1-1: Dropping payload (out of sync)
[26524.519697] usb 1-1: Dropping payload (out of sync)
[26524.519699] usb 1-1: Dropping payload (out of sync)
[26524.519701] usb 1-1: Dropping payload (out of sync)
[26524.519703] usb 1-1: Dropping payload (out of sync)
[26524.523634] usb 1-1: Dropping payload (out of sync)
[26524.523638] usb 1-1: Dropping payload (out of sync)
[26524.523640] usb 1-1: Dropping payload (out of sync)
[26524.523644] usb 1-1: Dropping payload (out of sync)
[26524.523646] usb 1-1: Dropping payload (out of sync)
[26524.523648] usb 1-1: Dropping payload (out of sync)
[26524.523651] usb 1-1: Dropping payload (out of sync)
[26524.523653] usb 1-1: Dropping payload (out of sync)
[26524.523655] usb 1-1: Dropping payload (out of sync)
[26524.523658] usb 1-1: Dropping payload (out of sync)
[26524.523660] usb 1-1: Dropping payload (out of sync)
[26524.523662] usb 1-1: Dropping payload (out of sync)
[26524.523665] usb 1-1: Dropping payload (out of sync)
[26524.523667] usb 1-1: Dropping payload (out of sync)
[26524.523669] usb 1-1: Dropping payload (out of sync)
[26524.523671] usb 1-1: Dropping payload (out of sync)
[26524.523673] usb 1-1: Dropping payload (out of sync)
[26524.523675] usb 1-1: Dropping payload (out of sync)
[26524.523678] usb 1-1: Dropping payload (out of sync)
[26524.523680] usb 1-1: Dropping payload (out of sync)
[26524.523682] usb 1-1: Dropping payload (out of sync)
[26524.523684] usb 1-1: Dropping payload (out of sync)
[26524.523687] usb 1-1: Dropping payload (out of sync)
[26524.523689] usb 1-1: Dropping payload (out of sync)
[26524.523691] usb 1-1: Dropping payload (out of sync)
[26524.523693] usb 1-1: Dropping payload (out of sync)
[26524.523695] usb 1-1: Dropping payload (out of sync)
[26524.523698] usb 1-1: Dropping payload (out of sync)
[26524.523700] usb 1-1: Dropping payload (out of sync)
[26524.523702] usb 1-1: Dropping payload (out of sync)
[26524.523704] usb 1-1: Dropping payload (out of sync)
[26524.523706] usb 1-1: Dropping payload (out of sync)
[26524.527632] usb 1-1: Dropping payload (out of sync)
[26524.527636] usb 1-1: Dropping payload (out of sync)
[26524.527638] usb 1-1: Dropping payload (out of sync)
[26524.527642] usb 1-1: Dropping payload (out of sync)
[26524.527645] usb 1-1: Dropping payload (out of sync)
[26524.527647] usb 1-1: Dropping payload (out of sync)
[26524.527649] usb 1-1: Dropping payload (out of sync)
[26524.527652] usb 1-1: Dropping payload (out of sync)
[26524.527654] usb 1-1: Dropping payload (out of sync)
[26524.527657] usb 1-1: Dropping payload (out of sync)
[26524.527659] usb 1-1: Dropping payload (out of sync)
[26524.527661] usb 1-1: Dropping payload (out of sync)
[26524.527663] usb 1-1: Dropping payload (out of sync)
[26524.527665] usb 1-1: Dropping payload (out of sync)
[26524.527668] usb 1-1: Dropping payload (out of sync)
[26524.527670] usb 1-1: Dropping payload (out of sync)
[26524.527672] usb 1-1: Dropping payload (out of sync)
[26524.527674] usb 1-1: Dropping payload (out of sync)
[26524.527676] usb 1-1: Dropping payload (out of sync)
[26524.527678] usb 1-1: Dropping payload (out of sync)
[26524.527681] usb 1-1: Dropping payload (out of sync)
[26524.527683] usb 1-1: Dropping payload (out of sync)
[26524.527685] usb 1-1: Dropping payload (out of sync)
[26524.527687] usb 1-1: Dropping payload (out of sync)
[26524.527689] usb 1-1: Dropping payload (out of sync)
[26524.527691] usb 1-1: Dropping payload (out of sync)
[26524.527694] usb 1-1: Dropping payload (out of sync)
[26524.527696] usb 1-1: Dropping payload (out of sync)
[26524.527698] usb 1-1: Dropping payload (out of sync)
[26524.527700] usb 1-1: Dropping payload (out of sync)
[26524.527702] usb 1-1: Dropping payload (out of sync)
[26524.527704] usb 1-1: Dropping payload (out of sync)
[26524.531634] usb 1-1: Dropping payload (out of sync)
[26524.531639] usb 1-1: Dropping payload (out of sync)
[26524.531641] usb 1-1: frame 2 stats: 0/451/451 packets, 0/0/0 pts (!early !initial), 0/0 scr, last pts/stc/sof 0/0/0
[26524.534416] usb 1-1: uvc_v4l2_poll
[26524.609581] usb 1-1: Device requested 3072 B/frame bandwidth
[26524.609584] usb 1-1: Selecting alternate setting 1 (3072 B/frame bandwidth)
[26524.906684] usb 1-1: Allocated 5 URB buffers of 32x3072 bytes each
[26524.916780] usb 1-1: uvc_v4l2_release
[26525.541452] usb 6-3.1: uvc_v4l2_open
[26525.541465] usb 6-3.1: uvc_v4l2_release
[26525.541479] usb 1-1: uvc_v4l2_open


So there is data being sent to the Linux box, but the kernel just doesn't like it. I'm neither a USB nor UVC expert, so I'll have to pass on further debugging, but I'll ping some friends.

[RuneHansen]

I should be able to add these cameras to IRCAM Thermal Viewer

[tsys]

Hey all,

while hacking on this camera together with Manawyrm I've designed a new 3D-printable top USB/micro SD port panel to improve continous hackability while the camera is fully assembled:


In addition to all ports on the stock panel it adds a cutout for a 3 pin .1 inch female header. This allows permanently exposing the internal serial port and thus bootloader and root shell on the device exterior.

The printable 3D model is available on Thingiverse and GitHub.

[jwet]

I saw the same Marco Reps video and grabbed one of these last week- love it- hoping it will be useful for electronic troubleshooting but its a great toy either way.  I spent an extra hundred and got the Topdon TC005 which has the visible camera and video functtion but looks identical.  I'm not quite ready to bust it open but if someone can tell me how to get the code out on the card or the USB cable, I'd be happy to grab an image and post it for the use of science.  Is this possible?

[Manawyrm]

Is this possible?

Hm, well, yes, I think it might be possible, but I don't know how exactly the update mechanism works yet
For now, I think it still requires an RS232 connection to the pins.

If you'd be willing to do that, I'd be happy to assist.

If someone else here is familiar with ELF/Linux32 armv7 binaries/reverse engineering, I'd also be happy to post the binary with the updater code, maybe someone else can understand it.

I'm not quite ready to bust it open

Marco shows it pretty well in the video, the only 2 really sketchy parts are the clips in the middle of the handle (we've just snapped them off on our camera now on purpose ) and the plastic screen cover (which you'll need to bend/lift without breaking it).
Generally, it's a pretty nice experience to open, don't worry.

[nsa666]

If someone else here is familiar with ELF/Linux32 armv7 binaries/reverse engineering, I'd also be happy to post the binary with the updater code, maybe someone else can understand it.

ghidra can't decompile it?

[Manawyrm]

ghidra can't decompile it?

Yes, it can, but that's not a one-stop-magical shop to readable C code
There's a bit more experience needed, I think

[jwet]

If someone really wants the firmware, I may tackle it.  Its only a week old...

Thanks for digging in.  It answered a lot of questions for me- especially the slow boot.

[Manawyrm]

Its only a week old...

Mine didn't even last 4 hours before I took a look inside (and that was because I had to finish the workday  )

If you'd feel comfortable with the soldering required to connect to J16 (those small pins) or can manage to find a fitting connector (I'm not sure what type of connector it is, sorry), I would appreciate that very much...
I'd be really curious about the differences between your firmware and mine...

Another benefit would be having the backup for yourself. The camera never shuts itself down properly. Every shutdown is a hard power-off without unmounting the ext4 filesystem on the internal flash. I'm not too confident that this will actually last long, so chances are that you might actually need the backup to restore the filesystem at some point in the future after it bricked itself. (ext4's journalling is pretty good these days, it might not actually break that quickly. We'll see.)

tsys is currently working on a really cool magnetic swappable lens attachment for it, which is looking _super_ promising.
So you might want to get familiar with taking it apart anyway

[nsa666]

If you'd feel comfortable with the soldering required to connect to J16 (those small pins) or can manage to find a fitting connector (I'm not sure what type of connector it is, sorry), I would appreciate that very much...

It looks like  M40-1100600 (1,00mm pitch) could fit. But i dont know for sure.

Edit: or M30-1100600 if it is 1,25mm pitch.

[Manawyrm]

This just had to be done:


 

It was surprisingly hard to do. Both video output and control input gave a bunch of trouble.
The video output/framebuffer was not actually RGB or something like that, but rather YVU420SP, aka semi-planar YUV (with U/V flipped) and sub-divided colors.
I just used /dev/mem to get a memory mapping for the physical address space and wrote directly to it:
https://github.com/Manawyrm/fbDOOM/blob/3c011e8c87bea3f29a52947410e9e4d1be036239/fbdoom/i_video_fbdev.c#L166

Input was also unnecessarily cruel, the buttons are all just GPIOs, but some of them don't have pull-ups and are somehow magically pulled up from the main application.
I've spent a couple hours banging my head against a wall and trying to get all of the GPIOs into the same state, but it still wouldn't enable the required pull-ups on all of the buttons. 
In the end, just not loading the kernel modules and just starting the main application briefly (which then segfaults due to missing dependencies) will setup the buttons correctly. Evil hack, but who's counting... After that, it's just a matter of reading the GPIO port states (yes, this is both ugly and slow, but we have 2x 1GHz, I don't care):
https://github.com/Manawyrm/fbDOOM/blob/3c011e8c87bea3f29a52947410e9e4d1be036239/fbdoom/i_input_tty.c#L38

[tsys]

Using the Vevor SC240N for microelectronics we found that the rather large minimum focus distance makes it difficult to differentiate between individual components.
I've designed a magnetic lens attachment that allows adding cheap ZnSe lenses to the camera. With the lens attachment minimum focus distance goes down from ~20cm to below 5cm.

Working with small SMD components the reduction in minimum focus distance makes all the differece:

Without lens attachment


With lens attachment


With the lens attached small heat sources (in this case 0402 LEDs) are easy to spot and clearly defined.

To make removal and swapping between different lenses as easy as possible the attachment is held in place magnetically:


From the factory there is nothing sufficiently magnetic close to the front of the camera to allow the magnetic lens attachment to stick. A couple of small magnets need to be glued into the device front shell:


The lens mount is fully 3D-printable in two pieces. The pieces are then connected using M1 self-tappers. Design files can be found on Thingiverse and GitHub.

[DH7DN]

Amazing hack, thanks for sharing 

[ragequit]

Hello there,

I got one a week ago, but it is currently being borrowed by friends. If someone could sent me the firmware binaries, especially the update routine, I would be willing to take a look.

Best regards

[bebopdk]

On the C200, this is in the apps.sh file, there seem to be something related to the streaming/uvc_gadget which is remarked out:

#!/bin/sh
#app
#cd /opt/qt4.8.5/demos/embedded/fluidlauncher
#./fluidlauncher -qws &
#usb otg
cd /lib/modules/3.14.38-6UL_ga\+ge4944a5/kernel/fs/configfs/
insmod configfs.ko
cd /lib/modules/3.14.38-6UL_ga+ge4944a5/kernel/drivers/usb/gadget
insmod libcomposite.ko
insmod u_serial.ko
insmod usb_f_acm.ko
insmod usb_f_mass_storage.ko
#insmod g_mass_storage.ko file=/dev/mmcblk0p1
insmod g_acm_ms.ko file=/dev/mmcblk0p1 removable=1 stall=1
#insmod g_webcam.ko streaming_maxpacket=1024

#gc0308 camera
cd /lib/modules/3.14.38-6UL_ga+ge4944a5/kernel/drivers/media/platform/mxc/subdev/
insmod mx6s_capture.ko
insmod gc0308_camera.ko

sleep 2
#app
cd /root
./IRay_C200_Thermal -qws -nomouse &
#./led_ctrl_test &

# ftp server
adduser nobody
vsftpd &

sleep 5
#./uvc-gadget &
./led_ctrl_test &
#apps

I have not played around with my C200 yet since I am a bit reluctant to take it apart while it is still under warranty, but would love to have the web cam working

[actuallyjaseg]

Y'all might be interested to hear that I have an older Infiray-branded C200, which *did* work as a webcam on Windows out of the box. If I find the time, I will pull an image of its flash later this weekend.

[bebopdk]

That firmware would be highly interesting to see, my C200(which when ordered should have been a C210), does not have that feature from the factory

[vfx_luis]

I'm still waiting for mine to show up, but in the Hisilicon Datasheet it states that the SoC has a HDMI 1.4 output (so 1080P60). Idk if the internal Screen uses that somehow, but just for the sake of it, do you think it would be possible to add an HDMI out to the camera?

Or better just stick with UVC?

[Manawyrm]

do you think it would be possible to add an HDMI out to the camera?

No, the required pins probably aren't connected to the SoC and we don't have either the HiSilicon SDK nor the InfiRay application source.
So I don't see any way of getting something like that too work. UVC will be the much better approach.

[Alibulala]

Does anyone know what is the deal with the lower resolution of the Vevor SC240 compared to the Topdon TC004 and Infiray C200?
(240x180 vs 256x192)
 Is it really a different sensor or just software locked?
Or are they selling sensors with some dead pixels under a cheaper brand name?

I´ve ordered the Vevor SC240M after I saw the Marco Reps video, but now I´m unsure if I want to keep it once it arrives, or send it back and get the Infiray or Topdon version. 

[Oreg]

Hey guys, I would like to hear your opinions on my issue with the Vevor SC240N.

I noticed that on my SC240N, the lens cover gasket was not installed properly, so it is oozing out. I was afraid that the IP54 rating is not valid. So I contacted Vevor support and they answered me that the protruding part can be cut off without affecting the use. Nevertheless they offer me a significant subsequent discount (almost 30 %) due to the inconvenience.

I've been toying with the idea of doing the magnetic macro lens modification anyway and could then use the opportunity to properly install the gasket myself.
So my question to the people who have opened their camera before: In your estimation, is vevor's statement accurate or should the seal be installed properly to ensure the IP54 rating?

[JohnPi]

The firmware for the TD004 is available at https://www.topdon.com/pages/pro-down.html?fuzzy=TC004

Its readme includes:

How to Upgrade Your TC004 Device?
1. Turn on TC004, and go to Setting >> System Setting >> USB Mode to switch to the USB Disk mode.
2. Connect TC004 to your Windows computer with the supplied USB cable, then go to https://www.topdon.com/pages/pro-down?fuzzy=TC004 and download the upgrade package file (IRPT_EMD_C200SE_V1473(107)-TC004) to the root directory of the TC004 SD card.
3. Unzip the file, and rename it as "update". (See figure below).
4. Press and hold the right button of the device for 10 seconds; then press and hold the left button while still holding the right button; release both buttons until the following update page appears on the device.

[bebopdk]

The same update for the TC005(with visual camera) can be found here:

https://lenkor-plat.oss-cn-hongkong.aliyuncs.com/topdon-web/information_app_file/Update%20software-TC005.zip

[JohnPi]

That's version 1.4.7.3 (103); my SC240M has a version 1.4.4 (102) Has anyone tried the TC005 firmware in a SC240M ?

[ImpulsiveJames]

Well crap, now I have to buy one.....

[Manawyrm]

Oh, that's awesome, I'm not sure how I missed that!

Thank you. I'll try to build a (no-hardware hacking required) firmware dumping image with that.

[Oreg]

I've been toying with the idea of doing the magnetic macro lens modification anyway and could then use the opportunity to properly install the gasket myself.
So my question to the people who have opened their camera before: In your estimation, is vevor's statement accurate or should the seal be installed properly to ensure the IP54 rating?

As it turns out, Vevor's statement may have been correct, as the seal is quite wide. Nevertheless, I have now installed it correctly.
I would love to unlock some more features on my SC240N like additional color palletes and video recording.

By coincidence I found a hidden menu which is partly english and partly chinese. I don't know the exact button sequence but I can trigger it sooner or later when I fiddle with the left/right buttons.
Hold left button, press right button 3x, keep right button pressed down and and press left button 3x. Repeat alternately until the menu opens.

[Fraser]

Google translate says.....

Update dat

Manual binding

Clear User table

Export Log

Get System Module ID

Update Splash screen

[Oreg]

And in the first line it says "update" badly recognizable in red font.

[zrq]

Translation of the menu:
Update
Update_dat
Manual marking of bad pixels
Clear user bad pixel table
Export logs
Get module systemID
Update start up screen/picture.

[pie314isi]

that menu is documented in the zipfiles linked above.

[pie314isi]

followup:
"Press and hold the right button of the device for 10 seconds; then press and hold the left button while still holding the right button; release both buttons until the following update page appears on the device."

[ragequit]

It seems like I have been looking in the wrong place

There is a really complex update procedure in iray_hisi_camera, but now I see the much simpler update procedure in iraytek_softer_01.

I am not certain yet, but it seems like i can just put a S90start file in the update folder on the SDcard and start the update via UI?

Can anyone confirm this before I brick my camera ?

here is the relevant function
https://paste.ofcode.org/bC8wYWgHYApgJqSudyCckw

[bap2703]

Just got a TC004.
On Win11, the camera app / vlc / obs see the camera but can't get the video.
The software from topdon, TDView, works.

I suspect some unusual encoding.
Manawyrm did you do something special to get it to work? I mean apart from completely hacking the device

[pinchies]

The ".h264" files should play in VLC fine. They are a h.264 video stream but are not packaged in the MP4 container format, so they are not very compatible with other software. To fix this, you can do a "convert" using VLC to export an MP4 file with passthrough video, and that worked well for me.

[bap2703]

I meant about the UVC streaming.

With Windows (both OBS and the native Windows 11 camera app) it works immediately.

With the TC004 that has streaming enabled by default, you still need to activate it in the menu, I can use Topdon's software to display the live video.
But any other software won't work.
Maybe Topdon's firmware has a different "encoding" of the streamed data?

[jetpad]

I have the Vevor SC240N and stupidly thought "maybe the firmware for the TC004 or TC005 will load on it". I did nothing to back up the original firmware and after performing the firmware install, of course, it just boots to the logo screen and hangs. Is this bricked for good or is there a way to reinstall the original firmware?

[Manawyrm]

Oops

Well, I do have an image of the original firmware and would be willing to share it.

Do you have serial console access already? With that you can probably recover it.

[jetpad]

Thanks, that would help a lot. I haven't opened it up yet to add the port but don't have anything to lose now.

[Honusnap]

I can see i'm not the only dumbass here 
I did it on my C200 Pro => same punition, C200 is staying on the boot screen... i guess you too have the nice TCView logo .. 

[Honusnap]

I'm in the same boat as Jetpad, if you got directions to solve this ...
I got the C200 Pro (same as Topdon TC005, well not entirely .. for sure .. i guess the systemID is different at least)

I'm all ear, what should i do ..? I think i got en FTDI somewhere, what chip do you use for USB/RS232 ?

My problem is that i got no firmware for the C200 Pro.
I got a firmware upgrade but... it's in Chinese, dunno if it's usefull to compare.. just ask me for it.

[Manawyrm]

I'm in the same boat as Jetpad, if you got directions to solve this ...

Well, not exactly directions, this might be a little hard to follow for an embedded hacking beginner, not sure how much experience you have.

The FTDI won't do the trick here, you would have to do the RS232 level conversion yourself. Much easier to buy one of the many USB to RS232.
Get a proper one like https://www.amazon.de/UGREEN-RS232-Seriell-PL2303-Chipsatz-Grau/dp/B00QUZY4UG (or similar in your region).

Then try to either solder wires or source a suitable connector for the serial port (pinout mentioned in the first post).
From there, after we have a shell, we can work out a solution to copy a fresh/original image file from an SD card to the eMMC flash.
I'm hoping that the Linux is still fine on both of your cameras and it's just the application software.
That would be ideal, because that means that we can use the Linux itself to recover the flash.

Otherwise, things get a lot more complex because we'd need to upload a new Linux image via RS232.
There's currently no Linux image which could be uploaded via RS232, so this would get a bit ugly.

[Honusnap]

Ok seen the J16, do you have the specs of the connector ?





EDIT : Ok i think i found it : JST SH1.0 6pin



Found a PL2303 : But have a question, i've read some pages on the subject and seems there are ... REAL RS232 levels (like 12V/5V), RS232 levels (like 5/3.3V).. i'm kind lost here, the PL2303 seems to be ok to connect to the C200 right ? It got RS232 levels at 3.3V or 5.5V, which voltage is the good one for the C200 board ?



Or maybe this one which is able to do far more : CP2102

[jetpad]

My solution was to solder one of these

    https://www.amazon.com/gp/product/B07PDQKHJ2/

to a little scrap connector I had. Then connecting that to

    https://www.amazon.com/gp/product/B0BG2BPVXV/

That connects to

    https://www.amazon.com/gp/product/B074VN9ZG4/

Which plugs into my MacBook. Just a temporary setup while it is disassembled.

[Honusnap]

Hello Jet,

Good, SH1.0 connector confirmed  , i would like to avoid the DB9 connector cause i haven't got any  , i bought the PL2303 and the CP2102 (which will help in my RS485 projects anyway), and a bunch of SH1.0 connectors .. should be ok...

[jetpad]

Ok, I was able to get the firmware loaded back on the SC240N thanks to Manawyrm. Lots of things tripped me up since this was a little out of my norm. The two main ones were: 1) The RX connection on the serial cable wasn't working so I thought the camera was ignoring me and 2) I wasn't pressing the spacebar fast enough to interrupt U-boot.

Now, after I put it all back together, I realized it wasn't displaying the correct hi, low and center temperatures correctly. It's displaying -273.1 C for all three. The thermal image looks right, it's just that the temperatures never change.

Do I need to do some sort of calibration? Has anyone else encounter this?

[Honusnap]

Hello,

I think i've read something about calibration being specific to each device (obviously), isn't there a menu to calibrate ..? I searched but did not find infomation while i think i've seen something about this...
About the reviving of your device, what did you flashed ..? The whole firmware through the firmware script, or just some files ?
Cause nobody seems to have the firmware i have on my device .. (chinese one) and so i got no source, appart from what seems to be a partial firmware (4 or 5 files).

[povlhp]

I can see that there is a solder free way to copy files to the Infiray C210, do anybody know if this works for this series as well ?
I have the Vevor SC240M aka C200 Pro (video recording and normal cam as well) - And if so, does somebody have an original usbdisksettings.sh or whatever I am going to replace ?
https://www.eevblog.com/forum/thermal-imaging/infiray-c210-thermal-camera-review/msg4368193/#msg4368193

[Honusnap]

Hello Jet,
Did you suceed calibrating your device ?
I'm in contact with Infiray and for my device the guy said i ned to send it back for flashing firmware again .. AND recalibrate the device, they also added that they need something called a dark mater to calibrate, it's something the temperature is well known.
But i suppose we can calibrate it with something else if we do not need extreme precision afterall.

About your SC240N, how did you flash the firmware ? What tools and procedure did you follow ?

I need to flash my C200 Pro (aka SC240M), if someone got a SC240M OR a C200 Pro firmware .. i would love to have it.

Thanks ..

[jetpad]

No it's still not back to the original state because I guess it needs to be recalibrated and I don't know if that is possible without sending it back. You've probably gotten farther along on that aspect since I haven't contacted Vevor about it yet. But it does display a thermal image, just without all the nice temperatures on it (and probably not in a calibrated way). Sorry, I don't have a copy of the SC240M firmware, just the SC240N. I don't remember the exact commands I used to get the firmware back on but it was something like this. Please verify each one before using them as I'm sure they need to be each customized for your setup. These were run on my MacBook after getting the serial cable working between the SC240N and the MacBook.

cd sbin
fdisk -l /dev/mmcblk0

diskutil list

diskutil unmountDisk /dev/disk4

sudo dd if=/Users/jetpad/Downloads/vevor-sc240n-firmware/vevor-sc240n-emmc.img of=/dev/rdisk4 bs=1m

; This command took about 10 minutes for me.
sudo dd if=path_to_image.img of=/dev/rdiskX bs=1m

diskutil eject /dev/disk4

/dev/mmcblk1

dd if=/dev/mmcblk1 of=/dev/mmcblk0 bs=4M

[Honusnap]

I checked both Topdon TC004 and TC005 firmware, they are identical BUT 2 files :

iray-hisi-camera-new
iraytek_softer_01_new

S90start seems different at first but is in fact differently organised.

Those 2 firmwares got different numbers :
TC004 : V1.4.7.8(109)
TC005 :  V1.4.7.8(105)

I also got a C200 PRo V1.3.8(131), S90start is the same as TC004 and TC005, iray-hisi-camera-new and iraytek_softer_01_new are also present and diferent then the TC004 or TC005.

Nobody got a Vevor firmware ?

[Gridstop]

I picked up one of these and am pretty happy with it so far, haven't opened it up yet though. I wanted to do it all at once when I put together the macro lens.

If anybody has used one of those 18mm CO2 laser lenses with it (such as the 3D print tsys posted on the first page) what focal length did you use? I'm not  sure if it's as simple as 'use a 5cm FL to get a 5cm minimum focal length' since I have no idea what optics are inside the camera otherwise. And the lenses are $25 each or so, so I'd prefer not to guess several times.

[cat99]

No it's still not back to the original state because I guess it needs to be recalibrated and I don't know if that is possible without sending it back.

not sure if it's relevant to your situation, but this amazon review mentions a possible calibration menu (I didn't try it)

I might have accidentally found the calibration menu, try this with your own risk, the menu is in simplified chinese for the most part:
1. hit "Back", hold "up" for one second, wait for one second, then hold "down" for roughly 3 sec, the calibration menu should appear, exit any time with the "Back" button.
2. hit "Back", hold "right" for one second, wait for one second, then hold "left" for roughly 3 sec, some kind of factory menu will show up, maybe for firmware update?

[cat99]

Does anyone know if there is a trick to updating the firmware on a unit that is running an older firmware?

I bought a topdon tc004 recently, when comparing it to videos online, my device is missing the "usb mode" menu entry, always running in mass storage mode.
The device is running firmware 1.2.1(1110), which seems older than the 1.4.x most people are running.
I tried updating to the current 1.4.7.8(109) but have not been able to get it to work.

I followed these steps:
put sdcard in device
tell it to format the sdcard
download the firmware rar file, unpack the contents including a zip file, unpack the zip file
connect the device to a computer
copy the folder that was contained in the zip file and rename it to "update"
disconnect from computer
hold right for 10sec, then while still holding right begin holding left, update screen appears

this is where I get stuck, instead of a list beginning with "update" and "update_dat", "update" is missing and it only has "update_dat"
if I select "update_dat" it responds in chinese:

sd card detected, updated started
no update file detected

I also found a link on archive.org for the older firmware, 1.4.7.3, but this failed in the same way.

I'm thinking the problem is most likely one of these:
option1- they have some older units that can't function in webcam mode, maybe can't be updated, and wanted to dump them on black friday
option2- the update process on older firmwares was different than on the newer ones, and the older process isn't documented anywhere
option3- I'm doing something wrong

[federigo]

Does someone with this device have this problem?

I know some kind of vignetting is considered normal, but it was my impression that the vignette is "colder". What I noticed during use is that I have some kind of "warm halo" on left/bottom side of the image. This is less noticable depending on NUC/range of what I have in view (though it is still noticeable by rotating the camera), but when pointing to a uniform surface is quite evident (picture attached of the camera pointed at a paper sheet).

The hottest point is always in the bottom-left side corner and the temperature difference between that spot and the coldest spot is always in the range of 1.8-2.2 °C



Can this considered "normal" or do I have a defective unit?

Also, the unit didn't come with any emissivity table in any form, it's set at 0.95 / 25 °C ambient temp / 0.5 m distance, how important is it to set these parameters if I don't care (too much) about absolute temperature measurements? I'm more interested in temperature differences and a rough indication of the actual temperature (if it's 30 °C instead of 35 °C is not important).

Thanks.

[jetpad]

not sure if it's relevant to your situation, but this amazon review mentions a possible calibration menu (I didn't try it)

Thanks. That does look very promising! I messed around with it but I was having trouble translating those menu options and wasn't able to figure it out. I'm going to keep trying.

[Honusnap]

Use google translate camera mode on your android phone .. easy to translate your IR screen.

[Honusnap]

Allright, after some ... annoying discussions with Infiray, and a stuck boot C200, i was able to install a Frankestein firmware based on a TC005, my device is working nice today and even better ... coming from a Chinese only device i now have a fully international device.

Infiray asked me 100€ to provide me with an international firmware while my device was Chinese only.... what a bunch of scammer.

[bap2703]

Does anyone know if there is a trick to updating the firmware on a unit that is running an older firmware?

I bought a topdon tc004 recently, when comparing it to videos online, my device is missing the "usb mode" menu entry, always running in mass storage mode.
The device is running firmware 1.2.1(1110), which seems older than the 1.4.x most people are running.
I tried updating to the current 1.4.7.8(109) but have not been able to get it to work.

On the software page
https://www.topdon.com/pages/pro-down?fuzzy=TC004
I see two versions. On for devices with four digits (V1.4.7.9) and one for devices with three digits (V1.2.7).

It seems you tried to put a 4 digit on a 3 digit.
Interestingly their version numbers without dots are reversed,
4 digits with dots = 3 digit number, 3 digits with dots = 4 digit number, as highlighted in your post. 

[brc]

If anybody has used one of those 18mm CO2 laser lenses with it (such as the 3D print tsys posted on the first page) what focal length did you use? I'm not  sure if it's as simple as 'use a 5cm FL to get a 5cm minimum focal length' since I have no idea what optics are inside the camera otherwise. And the lenses are $25 each or so, so I'd prefer not to guess several times.

In this post, jairbj said they used a 20 mm diameter, 50.8mm focal length lens: https://www.eevblog.com/forum/thermal-imaging/infiray-c210-thermal-camera-review/msg3698872/#msg3698872

[cat99]

Does anyone know if there is a trick to updating the firmware on a unit that is running an older firmware?

I bought a topdon tc004 recently, when comparing it to videos online, my device is missing the "usb mode" menu entry, always running in mass storage mode.
The device is running firmware 1.2.1(1110), which seems older than the 1.4.x most people are running.
I tried updating to the current 1.4.7.8(109) but have not been able to get it to work.

On the software page
https://www.topdon.com/pages/pro-down?fuzzy=TC004
I see two versions. On for devices with four digits (V1.4.7.9) and one for devices with three digits (V1.2.7).

It seems you tried to put a 4 digit on a 3 digit.
Interestingly their version numbers without dots are reversed,
4 digits with dots = 3 digit number, 3 digits with dots = 4 digit number, as highlighted in your post. 

Interesting, I checked archive.org to confirm none of the 3-digit vs 4-digit info was on that page last time I checked it.
A friend of mine who has the same device emailed Topdon asking about this and they replied saying units that run four-digit firmwares are the old hardware revision, three-digit firmwares are for the newer hardware revision.

I just installed 1.2.7 and it still doesn't have a "usb mode" to toggle between mass storage mode and webcam mode.

However after updating it I ran cheese (webcam tester) and was able to get video from the camera for around 5 seconds or so before it glitched out, which is encouraging, so maybe it just appears both as a mass storage device and a slightly non-standard webcam at the same time on these "newer" hardware revision models.

There is also a "super-resolution" option now, I looked at it briefly it appears to try and remove some of the macroblock style artifacts, and may be doing a sharpening filter of some sort.
Still images using "super-resolution" do generally look more asthetically appealing, I can't tell yet if it's a net positive when looking at the live video.

[brc]

In this post, jairbj said they used a 20 mm diameter, 50.8mm focal length lens: https://www.eevblog.com/forum/thermal-imaging/infiray-c210-thermal-camera-review/msg3698872/#msg3698872

https://www.thingiverse.com/thing:6051118 mentions using an 18 mm lens. Here's one option: https://www.aliexpress.us/item/2251832054759353.html

[Mrnilcs]

Dear thermal imaging enthusiast and hobbyists!!

I’m in middle of the process of evaluating this device’s capabilities so I’m reaching out: Could someone DM me some raw, uncompressed photos taken with SC240M? Especially interested in photos taken with the model with camera module.

Photos of interest to me are those taken from inside of apartment buildings, documenting temperature differences near window, vents, doors and bathroom floor/drains. Also curious to see how the apartment buildings look from outside-in. In this case, more is more so if you can provide multiple photos, I would greatly appreciate it!

My goal is to better understand the capabilities of the device: resolution and sensitivity in apartment and building context.

Here is my e-mail for image delivery: mazurka_spinach.0@icloud.com


Br,
Max

[Evolver]

Hi all!

Looks like my C200 Pro on Hisilicon HI3516DV300 platform is dead.

The thermal image looks very noisy and there are a lot of lines. And this is not a problem with the screen - the picture from the video camera and a menu are absolutely normal.

The camera was used for amateur purposes for about 2 years, about once a month. I guess not more than 3 full battery charges.
What's confusing me, is that the problem first appeared after two months. I wanted to use the warranty, but the camera is self fixed after the battery was completely discharged and then recharged. And then it worked perfectly. Until a few days ago, the problem arose again and it can no longer be solved with simple methods.

FFC events (shutter sound) occur frequently at powering on, but after a while everything goes to once per one/two minutes - looks normal for me.
I disassembled the camera, checked and cleaned all ribbon cables - no luck. 
All voltages on both boards are OK, the oscilloscope shows no noise on the capacitors.
The RTC battery is completely dead, it doesn't even charge, although 3.2v present, when the camera is on.

Judging by the attached log and numerous messages
"[1970-01-01 00:00:12][LIB]: HisImageProcess error."
unit experiencing problems communicating with ELF1 (thermal module) image processor.
I guess troubles even not with the connection itself, but processing of the received data.

But thermal image is alive, i can see the outline of my hand, the center point showing like the right temperature. But there is a lot of noise from the min to max values of the measurement range at the same time.

Masking different lines in S90start I found out that "HisImageProcess error" occurs when launching /iray_app/iray-hisi-camera, which initializes the communication with the thermal module and eventually displays the thermal image on the screen. The problem is exactly in this place. And only after that /iray_app/iray_softer_01 - the user shell - is launched, but this does not change anything in the corrupted image.

Fraser, can your wealth of experience tell - if this is a hardware or software problem? I think it's faulty thermal module/integrated image processor...

By the way, there are 8Gb eMMC disk and 512M RAM inside - quite a powerful thing.

[Fraser]

Evolver,

That looks like a nasty fault. As to whether it is hardware or software that is causing it, I cannot be certain. This fault would need some detailed investigation of the signals coming out of the microbolometer module.

Fraser

[Evolver]

Thank you.
I suspected that there is no easy solution here. So I bought another one full clone of that camera Mileseey TR256B. It can be included it in the topic title. The only difference from C200Pro is a body color, even measured weight is same. At least if it breaks too, I can assemble one frankenstein from parts of two ones  .