Flir E4 Thermal imaging camera teardown

[Taucher]

On that subject, you know you put your user/machine name in the HTTP request a few pages ago, right? Not that those were highly exciting, but just so you know.

I assume you're referencing "EXISTS/EXISTSALSO" ... that's not my username or machine-name

That was likely since it was highly contrived, but you never know. But more importantly, 6% @ 1290mA. yay!

But you were close - it almost got past my scanning eyes because they added the hostname twice (once standalone, once as windows domain prefix) and my hostname isn't standing out in such a string - username neighter ... so nearly overlooked that one.

[KingVidiot]

OK, E4 hack is working well, but I need to fix this calibration step. What file do I edit to change the NUC values?

Manual Re-Cal(NUC): keep holding down "Playback"
@File: you can probably put it in any <additional config> file that you like <as long as it's getting loaded> - or just run the wanted commands via telnet before recording a vid.
If you're asking yourself about rset and how to ... -> use telnet and don't use any file as this will change the default settings after startup.
[/quote]

Indeed. I'd keep that bit of config non-permanent. Personally I'd use a telnet script. Or you can make a .FIF that executes those rset commands. That way before you start recording you do pointey clickey in FlirInstallNet, and apply that .FIF.
[/quote]

I guess I'm confused. Didn't these options come form an existing cfg file?
# turn off auto-nuc
rset .tcomp.services.autoNuc.active false
# turn on auto-nuc
rset .tcomp.services.autoNuc.active true
# trigger nuc
rset .image.services.nuc.commit true

I would rather make the settings permanent since I can always ftp a fixed file back into the cam if I don't want it off. Since I'll be doing a lot of video, it makes sense to have it off and only available when I push the play button.

Do you have a turnkey solution? I'm not experienced at this stuff. I'm very grateful for any help.

[Taucher]

@KingVidiot:
did you ever connect to your camera via telnet?!
if not: learn how to do that - it's easy and was explained multiple times here.
then just enter the rset commands that you like.

[KingVidiot]

@KingVidiot:
did you ever connect to your camera via telnet?!
if not: learn how to do that - it's easy and was explained multiple times here.
then just enter the rset commands that you like.

I'll give it a go, thanks.

At least I can do that from a Mac or PC. 

[Taucher]

Off Topic: US ARMY Camera Catches Afghans gangbanging a goat (TIC video)
... www.liveleak.com/view?i=93d_1384239379
 

[Fraser]

Cruel Ba**ards....I hope they catch something really nasty and their d*cks fall off !

[Mr-Beamer]

BINGO, HOME-CALLING![/size]
"Bloody, Spying BASTARDS"
 

This (and more) is beeing sent to Google:

When starting:   
   &utmn=<SOME NUMBER>
   &utmhn=<THE WINDOWS MACHINE HOSTNAME>
   &utme=5(Application start*4.0.13284.1003*)(0)8(Origin*OSCulture*OSBits)9(EXTERNAL*<LOCALE>*<OS-BITS>)....

When opening the images browser:
   &utmdt=Library Tab   

When looking at an image:
   &utmdt=Edit Window 
   
Feel free to contribute more!


I understand developers who want to optimize their product and provide the user with a better experience, but then... what for do they need my machine's name for?!
Tons of additional numbers beeing sent (click/mouse coordinates?) ... could also be encoded username, password, IP... (ok, that's now just my paranoia kicking in)...
Opt-out function: didn't see any

I don't like that at all!

PS: sending referer: http://library.tools.flir.com

not only do they sent stuff to google.


Host: internalstore.flir.com\r\n
Connection: Keep-Alive\r\n
\r\n
Full request URI: http://internalstore.flir.com/?productname=FLIR%20Tools%2B&licensefileid=XXXXX&licenseserialnumber=&computername=XXXXXXX&username=XXXXXXX%5CXXXX

Response Phrase: Moved Temporarily
location: http://www.flir.com/internalstore/\r\n

[ixfd64]

Maybe they have a secret deal with the NSA?

[homr]

No wonder they are dieing for virgins.

[Rasz]

Nice Taucher
I see GoogleAnalyticsTracker.dll is in the previous version also
Without it in the progdir Flirtools crashes

Ok, stole myself some additional time and did an investigation on the Google Analytics DLL:

Found URLs inside DLL:
http://www.google-analytics.com/__utm.gif
https://ssl.google-analytics.com/__utm.gif

As said had to check my hosts file first ... had them blacklisted already...
0.0.0.0      ssl.google-analytics.com
0.0.0.0      www.google-analytics.com
... ok, temporarily redirected them for testing to my local http-server.. fired up the tools and   hold and beware...
BINGO, HOME-CALLING!
"Bloody, Spying BASTARDS"
 

This (and more) is beeing sent to Google:

When starting:   
   &utmn=<SOME NUMBER>
   &utmhn=<THE WINDOWS MACHINE HOSTNAME>
   &utme=5(Application start*4.0.13284.1003*)(0)8(Origin*OSCulture*OSBits)9(EXTERNAL*<LOCALE>*<OS-BITS>)....

When opening the images browser:
   &utmdt=Library Tab   

When looking at an image:
   &utmdt=Edit Window 
   
Feel free to contribute more!


I understand developers who want to optimize their product and provide the user with a better experience, but then... what for do they need my machine's name for?!
Tons of additional numbers beeing sent (click/mouse coordinates?) ... could also be encoded username, password, IP... (ok, that's now just my paranoia kicking in)...
Opt-out function: didn't see any

I don't like that at all!

Some of those andom looking numbers is individual OS fingerprint and camera SN so they can track individual users. I wouldnt be surprised if they also fingerprinted pictures taken with the camera.
Im pretty sure its illegal in EU :/

[amyk]

Not if it's buried in the EULA somewhere...

[Taucher]

@Eula:
Legal or not, Eula or not - it's just another piece of gathering market data without giving the user an option to say "no, I don't want to be tracked"... but I guess it's easier not to bother customers.
Also not to forget - that tracking will not stop sending data if you have a paid or volume-accounted internet access (like mobile surfing with your notebook etc.).

@Updater

not only do they sent stuff to google.
Full request URI: http://internalstore.flir.com/?productname=FLIR%20Tools%2B&licensefileid=XXXXX&licenseserialnumber=&computername=XXXXXXX&username=XXXXXXX%5CXXXX

yes, wrote about that too - but didn't highlight it with as it would have deserved to ...

... btw - note that it's not even trying to use SSL to provide any level of network security or prevent misuse of a hijacked update data stream (ok, who would bother...)

[mrflibble]

Not if it's buried in the EULA somewhere...

Sure it is. Or did you fulfill the requirement in your EULA stipulating that you kill at least 2 bunnies per day and evade taxes? Just because some legal droid vomited up some randomized sequence of characters doesn't make said vomit legal.

"By looking at this legal document you agree to  ..." yeah, good luck with that.

[mrflibble]

Google lookenpeepers aside, some info on the flash partitions.


\>diskutil -L

Store "NAND FLASH":
Device Name: "DSK1:"
Description.: NAND FLASH
Partitions: 1
Mount Count: 1
Device Type: FLASH
Device Flags: |STORAGE_DEVICE_FLAG_READWRITE|TRANSACTED|
Device Attributes:
Number of Sectors: 8192
Bytes per Sector: 2048
Free Sectors: 0
Biggest Partition Creatable (sectors): 0

Partiton "Part00" on "DSK1:":
        Partition Name: "Part00"
        File System: exfat.dll
        Volume Name: FlashFS
        Volume Attributes:      Volume Flags: |WFSC_SUPPORTED|LOCKFILE_SUPPORTED|STORE|
        Number of Sectors: 7104
        Partition Type: NTFS or SDXC
        Partition Attributes: |MOUNTED|

Store "NAND FLASH":
Device Name: "DSK2:"
Description.: NAND FLASH
Partitions: 1
Mount Count: 1
Device Type: FLASH
Device Flags: |STORAGE_DEVICE_FLAG_READWRITE|TRANSACTED|
Device Attributes:
Number of Sectors: 91904
Bytes per Sector: 2048
Free Sectors: 0
Biggest Partition Creatable (sectors): 0

Partiton "Part00" on "DSK2:":
        Partition Name: "Part00"
        File System: exfat.dll
        Volume Name: FlashIFS
        Volume Attributes:      Volume Flags: |WFSC_SUPPORTED|LOCKFILE_SUPPORTED|STORE|
        Number of Sectors: 89280
        Partition Type: NTFS or SDXC
        Partition Attributes: |MOUNTED|

Store "NAND FLASH":
Device Name: "DSK3:"
Description.: NAND FLASH
Partitions: 1
Mount Count: 1
Device Type: FLASH
Device Flags: |STORAGE_DEVICE_FLAG_READWRITE|TRANSACTED|
Device Attributes:
Number of Sectors: 20480
Bytes per Sector: 2048
Free Sectors: 0
Biggest Partition Creatable (sectors): 0

Partiton "Part00" on "DSK3:":
        Partition Name: "Part00"
        File System: exfat.dll
        Volume Name: FlashBFS
        Volume Attributes:      Volume Flags: |WFSC_SUPPORTED|LOCKFILE_SUPPORTED|STORE|
        Number of Sectors: 19328
        Partition Type: NTFS or SDXC
        Partition Attributes: |MOUNTED|


Those are the FlashFS, FlashBFS and FlashIFS mountpoints we already knew. I suppose the root directory (with \windows and \temp etc in it) is just a ramdisk that's initialized during WinCE boot.

[M. András]

Nice Taucher
I see GoogleAnalyticsTracker.dll is in the previous version also
Without it in the progdir Flirtools crashes

Ok, stole myself some additional time and did an investigation on the Google Analytics DLL:

Found URLs inside DLL:
http://www.google-analytics.com/__utm.gif
https://ssl.google-analytics.com/__utm.gif

As said had to check my hosts file first ... had them blacklisted already...
0.0.0.0      ssl.google-analytics.com
0.0.0.0      www.google-analytics.com
... ok, temporarily redirected them for testing to my local http-server.. fired up the tools and   hold and beware...
BINGO, HOME-CALLING!
"Bloody, Spying BASTARDS"
 

This (and more) is beeing sent to Google:

When starting:   
   &utmn=<SOME NUMBER>
   &utmhn=<THE WINDOWS MACHINE HOSTNAME>
   &utme=5(Application start*4.0.13284.1003*)(0)8(Origin*OSCulture*OSBits)9(EXTERNAL*<LOCALE>*<OS-BITS>)....

When opening the images browser:
   &utmdt=Library Tab   

When looking at an image:
   &utmdt=Edit Window 
   
Feel free to contribute more!


I understand developers who want to optimize their product and provide the user with a better experience, but then... what for do they need my machine's name for?!
Tons of additional numbers beeing sent (click/mouse coordinates?) ... could also be encoded username, password, IP... (ok, that's now just my paranoia kicking in)...
Opt-out function: didn't see any

I don't like that at all!

PS: sending referer: http://library.tools.flir.com

this is the very reason i set up the firewalls to interactive mode anything tries to connect to the internet triggers a user response window so i can decide i allow it or not apart from basic windows stuffs not too much is allowed to communicate on my computer, im sick of data gathering for improvements purposes of course without any data which can be used to identify you. yeah sure os license etc is not usable for that purpose bullshit....

[Isailer]

I received my new E4 a few days ago but I noticed with the lens cover closed, the unit shows a ~15F degree temperature gradient. Does this mean the unit is defective?

[BigClive]

Is it diagonal by any chance?  If you look back through the recent posts you'll see someone else had what appeared to be an obstruction in the cameras field of view which may have been the calibration shutter mechanism failing to retract fully or even becoming loose inside the unit due to either a manufacturing issue or a serious impact in transit.

If you do find it persists and affects the results in normal operation then don't do the hack as you may need to contact your supplier to exchange the unit.

[KingVidiot]

So after the hack my simple workflow of connecting the cam to my Mac and streaming to a Quicktime video doesn't work. The Flir is no longer an option as a capture camera in QT. I tried all sorts of USB modes on the cam but no luck. I can browse the cam in the MacOS Finder for the DCIM folder, but that's about it.

Anyone else see this? Any ideas for what is going on? I was going to shoot some vids at work today. Grrrr...

[Taucher]

So after the hack my simple workflow of connecting the cam to my Mac and streaming to a Quicktime video doesn't work. The Flir is no longer an option as a capture camera in QT. I tried all sorts of USB modes on the cam but no luck. I can browse the cam in the MacOS Finder for the DCIM folder, but that's about it.

Anyone else see this? Any ideas for what is going on? I was going to shoot some vids at work today. Grrrr...

get sleep, read syslog, cold restart any component involved and take close care to have the modes set up right... btw: I don't buy mac

[KingVidiot]

Thanks. It's not a Mac thing. My Win7 ultimate has the same issue. 

I'll keep playing with the stuff...

[KingVidiot]

Silly me, it was a camera setting, or a reboot of the cam and with a camera setting. 

Sorry for the false alarm. Strange, it didn't work on that setting before.

At least I can shoot some animal footage at work now.
Stay tuned for the vids...

[iceisfun]

Silly me, it was a camera setting, or a reboot of the cam and with a camera setting. 

Sorry for the false alarm. Strange, it didn't work on that setting before.

At least I can shoot some animal footage at work now.
Stay tuned for the vids...

Post some pics when you can

I have some pictures of my bird

[olsenn]

I knew it would be only a matter of time before someone took a picture of their bird!

[Kaptein QK]

Just don't flip it! 

[mrflibble]

Just don't flip it! 

Too late!