Flir E4 Thermal imaging camera teardown

[Rainer]

Fp said, there are no difference between the conf.crc from my TIC and his TIC. Did they use the same fix xor to crypt?

And somebody said, there are some binaries missing. Is this the reason for the difficulties with some parts of the Beta3-Menues?

[fp]

Actually, I said that there was no difference in the binary strings that followed the CRC characters at the end of the file. But the rest surely is different, which means the key is different. I have no time right now to brute force my xored file, but it looks like nowadays there are smarter tools, will look into it later. Hopefully with 2 different keys we might get a clue as to how they are produced ?

[schdiewen]

For those who want to get their own keyfile:

Attached you find a quick-and-dirty octave (or matlab) script, which tries to extract your personal key.bin if you feed it your conf.cfc and a plain conf.cfg (e.g. from my previous zip) for comparison.

Usage:
getkey('conf.cfc', 'conf.cfg');

All files have to be present in the current working folder, the resulting key.bin is also written there.

Edit: Of course you should use the ~6kb conf.cfc found in the appcore.d tree 

Edit 2: I should note, that this script silently assumes that the key length and structure of conf.cfc is constant for all cams and just chooses the most common values after XORing the input files. So the written key can as well be complete nonsense, if those assumptions are wrong.

[daves]

For those who want to get their own keyfile:

Attached you find a quick-and-dirty octave (or matlab) script

If someone will collect cfc files (at least 3) and post them, I can decode the key and try to make decoder and encoder app.
Anyway, we would need the CRC03 to give a try.

[fp]

@daves: not sure what you meant, but here is a zip file which contains the 3 cfc files from my tree (hence, presumably encoded with the same key). I will try Schdiewen's script later.

[treefiddy]

Hi guys!  The "E8" is working great.  I have a couple questions... Is there a way to connect this to an ipad to transfer pics, or do you have to step up to the Exx series with the wifi?  Also, has anybody performed the "hack" on an E30 to make it an E60? 

Any help is greatly appreciated.  Thank you.

[tomas123]

Is there a way to connect this to an ipad to transfer pics, or do you have to step up to the Exx series with the wifi?

read https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg370551/#msg370551

[Rainer]

so, i´m at home now and can play around a little more with my TIC.

Is there any reason to do the i2c-thing? or is it obsolete with the decoding of the config-file?

the cofig is decrypted or not? can anybody give me a patched config to test? and what is the crc?

is there any solution with the missing binaries? can anybody upload them? then i try to test them with telnet... 

[Fraser]

Blimey, I don't visit this thread for a few hours and suddenly there are people crcaking open the CFC file     

Well done to those rising to this challenge, it makes facinating reading.

Aurora

[schdiewen]

@tomas123: Great howto  Didn't know Octave for Windows requires cygwin

to do
(1) @taucher: crc03 keygen
(2) hack the tail https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg400616/#msg400616
(3) check key SUID in /FlashIFS/FLIRVers.rsc

Don't forget about those padding bytes, the crypted files aren't just "input xor key + trailer", there are some non-zero bytes added between the EOF and CFC-trailer, possibly for increasing the file size to multiples of 32. The trailer itself looks easy, the differing bytes seen in your post are the file size before padding+trailing is applied (conf.cfc: "99 18" -> 0x1899 -> 6297 Byte).

But since we saw Rainer accidentally booting his cam OK (?) with a misplaced conf.cfc, maybe we can just hexedit the padding and see if the cam still uses the config. Then it's most likely junk (uninitialized buffer etc.) and can be zeroed.

PS: Nice to see there is a ready-to-use python script for XORing 

[tsg]

wow, what an effort guys!
I purchased my camera today, hopefully will be able to help when I get it.
I wouldn't want to lose the warranty just jet by modding it but it is good to have the tools up our sleeve
Keep up the good effort
TSG

[Rainer]

tsg, you can post the next(third) full-backup for analysis.

Just install the filezilla and the flir-network-driver on your pc,

then go in TIC in the hidden menue(Settings->device-settings->camera-information->10 seconds right and activate in the usb-menue the RNDIS-option)
(later you can do in the same way to reset to the UVC and MSD-option)

If RNDIS is on, connect  with filezilla to 192.168.0.2, user: flir, pass: 3vlig and dowload and zip all files.

Then post the zip here und give some information about your cam (you find the data in the camera-information-menue)

all this operations don´t touch any warranty

here is the driver:
http://cdn.cloud.flir.se/swdownload/assets/other/flir_device_drivers.exe


I have done the i2c again:

first, i build a little txt for the i2c.exe to scan the bus:

Existing Adresses:
00, 01 only reading, error 1d when writing the start-zero
and
92, 93, AA, AB, AE, AF, D0, D1

Code: [Select]

\FlashBFS\system>i2c.exe r 00 100
Open I2C device
I2C read command 0 100 returned: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

\FlashBFS\system>i2c.exe r 01 100
Open I2C device
I2C read command 0 100 returned: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

\FlashBFS\system>i2c.exe r 92 100 00
Open I2C device
I2C read command 49 100 returned: 16 CC FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

\FlashBFS\system>i2c.exe r 93 100 00
Open I2C device
I2C read command 49 100 returned: 16 D0 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

\FlashBFS\system>i2c.exe r AA 100 00
Open I2C device
I2C read command 55 100 returned: 23 1 0 0 FF FF 9E B CD E 38 1 ED 6 16 B 47 6 70 A 7A 0 FF FF 8 2 FD FF 84 8A C0 FC 74 0 C0 15 CE 1 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

\FlashBFS\system>i2c.exe r AB 100 00
Open I2C device
I2C read command 55 100 returned: 23 1 0 0 FF FF 9D B C8 E 38 1 ED 6 16 B 47 6 70 A 80 0 FF FF 8 2 FD FF 84 8A C0 FC 74 0 C0 15 E4 1 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF

\FlashBFS\system>i2c.exe r AE 100 00
Open I2C device
I2C read command 57 100 returned: 46 4C 49 52 20 45 34 0 0 0 0 0 0 0 0 0 0 0 0 0 36 33 39 30 31 2D 30 31 30 31 0 0 0 0 0 0 36 33 39 31 34 37 35 32 0 0 32 30 31 34 2D 30 32 2D 31 33 0 0 30 31 0 0 DE CA 54 31 39 38 32 38 33 0 0 0 32 30 31 33 36 30 31 36 0 0 31 31 0 0 0 0 0 0 0 0 ED 9C FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF A F4 3C 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 46 F4 54 31 39 38 33 30 34 0 0 0 36 33 38 31 33 38 30 38 0 0 30 31 0 0 FF FF FF FF FF FF F2 9F 50 0 3C 0 0 1 0 0 0 0 0 0 0 0 8C 1 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 0

\FlashBFS\system>i2c.exe r AF 100 00
Open I2C device
I2C read command 57 100 returned: 46 4C 49 52 20 45 34 0 0 0 0 0 0 0 0 0 0 0 0 0 36 33 39 30 31 2D 30 31 30 31 0 0 0 0 0 0 36 33 39 31 34 37 35 32 0 0 32 30 31 34 2D 30 32 2D 31 33 0 0 30 31 0 0 DE CA 54 31 39 38 32 38 33 0 0 0 32 30 31 33 36 30 31 36 0 0 31 31 0 0 0 0 0 0 0 0 ED 9C FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF A F4 3C 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 46 F4 54 31 39 38 33 30 34 0 0 0 36 33 38 31 33 38 30 38 0 0 30 31 0 0 FF FF FF FF FF FF F2 9F 50 0 3C 0 0 1 0 0 0 0 0 0 0 0 8C 1 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 0

\FlashBFS\system>i2c.exe r D0 100 00
Open I2C device
I2C read command 68 100 returned: 16 15 21 4 6 3 14 B3 0 2 0 4 0 30 40 0 10 80 0 0 0 0 98 8 0 14 0 2 0 0 40 10 90 0 0 0 0 80 0 30 0 4 11 0 4 40 0 0 20 0 0 0 0 10 0 0 4 40 4 8 6 21 24 82 16 15 21 4 6 3 14 B3 0 2 0 4 0 30 40 0 10 80 0 0 0 0 98 8 0 14 0 2 0 0 40 10 90 0 0 0 0 80 0 30 0 4 11 0 4 40 0 0 20 0 0 0 0 10 0 0 4 40 4 8 6 21 24 82 16 15 21 4 6 3 14 B3 0 2 0 4 0 30 40 0 10 80 0 0 0 0 98 8 0 14 0 2 0 0 40 10 90 0 0 0 0 80 0 30 0 4 11 0 4 40 0 0 20 0 0 0 0 10 0 0 4 40 4 8 6 21 24 82 16 15 21 4 6 3 14 B3 0 2 0 4 0 30 40 0 10 80 0 0 0 0 98 8 0 14 0 2 0 0 40 10 90 0 0 0 0 80 0 30 0 4 11 0 4 40 0 0 20 0 0 0 0 10 0 0 4 40 4 8 6 21 24 82

\FlashBFS\system>i2c.exe r D1 100 00
Open I2C device
I2C read command 68 100 returned: 25 15 21 4 6 3 14 B3 0 2 0 4 0 30 40 0 10 80 0 0 0 0 98 8 0 14 0 2 0 0 40 10 90 0 0 0 0 80 0 30 0 4 11 0 4 40 0 0 20 0 0 0 0 10 0 0 4 40 4 8 6 21 24 82 25 15 21 4 6 3 14 B3 0 2 0 4 0 30 40 0 10 80 0 0 0 0 98 8 0 14 0 2 0 0 40 10 90 0 0 0 0 80 0 30 0 4 11 0 4 40 0 0 20 0 0 0 0 10 0 0 4 40 4 8 6 21 24 82 25 15 21 4 6 3 14 B3 0 2 0 4 0 30 40 0 10 80 0 0 0 0 98 8 0 14 0 2 0 0 40 10 90 0 0 0 0 80 0 30 0 4 11 0 4 40 0 0 20 0 0 0 0 10 0 0 4 40 4 8 6 21 24 82 25 15 21 4 6 3 14 B3 0 2 0 4 0 30 40 0 10 80 0 0 0 0 98 8 0 14 0 2 0 0 40 10 90 0 0 0 0 80 0 30 0 4 11 0 4 40 0 0 20 0 0 0 0 10 0 0 4 40 4 8 6 21 24 82


Maybe is the xor-key in it anywhere?

[fp]

Hi guys,

bad news, I now have a very expensive paperweight: downgrading went fine (well, except for a couple of complains here and there but not of them looked that bad. didn't think to copy/paste the log before hitting "reboot"....) and then, upon reboot of the unit, I got a FAT partition mounted on my laptop with 2 files, ERROR.TXT which says "no error" (how ironic) and TYPEINFO.TXT which has

FLIR cam boot
MSDcmd 1.3
ASCO

and then 2 serial (including the one from the unit) and the ethernet MAC of the unit. The unit itself just displays the FLIR logo.

I suppose my best bet is to return it, unless somebody has any brilliant ideas ? (don't feel sorry. Gambling implies losses...)

So there *is* something lurking at the firmware level, I would say...

[tomas123]

no FTP/Telnet access?

[fp]

No. It appears to just behave like an sd card.the volume is name ASCO, and its size is 25 MB.

So, most likely the other stuff is there, but not accessible nor booting.

I was honestly not expecting things to work, but I wasn't expecting to be left with a brick with no warning ? Ah well. Interesting discussion ahead with the retailer...

[stefbeer]

[...] upon reboot of the unit, I got a FAT partition mounted on my laptop with 2 files [...]

If you've been able to see those partitions, I assume you left the TIC connected to your computer during reboot.
Stupid question: Did you try to reboot it without the USB connection present? If I remember correctly somebody posted about issues during booting while connected to a computer.
And have you been able to see any other USB device from the TIC? Like the network device, a UVC device, a serial port or anything else besides the mass storage device?
Could you also tell us how big those partitions are? Have you looked for any hidden files on those partitions?
One last question: Is FLIRInstallNet able to see / discover the TIC?

[tomas123]

you have been warned but the Flir Service can restore the firmware

from "How to Update your FLIR Exx series.pdf"

Important note
The camera may be damaged if power or USB communication is interrupted during the update. Do not turn off the camera, or remove or disconnect the power source, or the USB cable.
If the update is not completed successfully and the camera becomes inoperable, the camera has to be sent to a FLIR service representative.

I think, there is a urloader (like u-boot)

[stefbeer]

Either they can restore / reflash the firmware or they just swap the unit when you send it to their service.
But the fact that the unit puts it's serial number and MAC address in this file sounds like some kind of "Hello! This is me. FEED ME!" to me.
I'm sure there's some way of unbricking it. Maybe it's waiting for some files to be put on those partitions?
@fp: I'm just thinking out loud, I'm not saying you should put anything there

[Taucher]

No. It appears to just behave like an sd card.the volume is name ASCO, and its size is 25 MB.

So, most likely the other stuff is there, but not accessible nor booting.

I was honestly not expecting things to work, but I wasn't expecting to be left with a brick with no warning ? Ah well. Interesting discussion ahead with the retailer...

USB VENDOR and DEVICE ID?

[fp]

Oh yes, I am not complaining 

and
- I only see this FAT partition.
- Flir Tools/FlirInstallNet does not see the TIC (I could update Flir Tools, but I don't think it will make a difference. I did install the OSX version of it on another laptop, it is the latest version from January but it does not see anything either).

I don't see how I could see a serial line there, over the USB cable, but any suggestion are welcome (before I ship it back).

I am somewhat sceptical that they have to tear it open to fix the firmware, tho. There has to be a way to get a low level connection....

and yes, the info that is left on the FAT partition strongly suggests it !


(ah, @Taucher, wait a minute, I need to re-open the case and connect it again)

[fp]

FLIR Removable Disk:

  Product ID:   0xffff
  Vendor ID:   0x09cb
  Version:    0.00
  Speed:   Up to 480 Mb/sec
  Manufacturer:   FLIR Systems
  Location ID:   0xfa130000 / 6
  Current Available (mA):   500
  Current Required (mA):   500
  Capacity:   25,2 MB (25 165 824 bytes)
  Removable Media:   Yes
  Detachable Drive:   Yes
  BSD Name:   disk2
  Partition Map Type:   Unknown
  S.M.A.R.T. status:   Not Supported

[Taucher]

try putting the update files onto the fat drive - there was some autoexec mechanism on the supplied .exe
edit: need to check if it was eFLIRInstall.exe

[stefbeer]

I don't see how I could see a serial line there, over the USB cable, but any suggestion are welcome (before I ship it back).

One possibility on windows (as far as I know) would be to open the windows device manager and look for any device that might be from the unit. But that is a bit tricky because you have to expand every single category.

On a Linux machine you could make use of the "lsusb" command. You wrote you had a laptop with OSX, a quick google search lead me to this: http://www.tekkie.ro/mobile-development/osx-list-usb-devices-lsusb-equivalent/
Maybe you could provide us with that information

[Taucher]

@FPGA experts: I'm guessing the FPGA has a factory deployed serial number - my guess is it's the new GUID code

[fp]

I was wondering indeed if dropping the update files there could be a good move. Well, it won't hurt at that point, right ? Although I suppose I should probably put the latest firmware rather than the older...

Anyway, there is an eFLIRInstall.exe in the zip. Runing strings on it yields a bunch of interesting stuff, like

"About to destroy boot config to force TFTP download on next boot"

and all sorts of other fun things like

Usage: flash [cmd]
  -e <eboot.nb0>    Flash bootloader
  -n <nk.bin>       Flash OS Image file
  -n <fs.bin>       Flash file system image file(s)
  -b <bitmap.bmp>   Flash boot bitmap
  -c bitmap         Clear boot bitmap
  -f [<part>]       Create flash file system image file
  -nomount          Do not remount file system after file generation
  -k                Keep file system(s) mounted (caution)
                    This flag can be combined with any of the commands
  -l                No partition limit check when writing binary (caution)
  -destroy          Destroy boot config to force TFTP download on next boot

bit late to do anything, will wait until tomorrow morning !
Thanks for the hints