Flir E4 Thermal imaging camera teardown

[difxati]

My updated Flir E4 (with Software 2.11) has all Functions mentioned above, including Zoom.
The one and only function missing is the Manual Temperature Scale adjust.

But before 2lps changed my config.cfc half of the (E8) Menu was missing.

Greetings
Kai

Can you share the changed config.cfc with us? Thanks

[difxati]

My updated Flir E4 (with Software 2.11) has all Functions mentioned above, including Zoom.
The one and only function missing is the Manual Temperature Scale adjust.

But before 2lps changed my config.cfc half of the (E8) Menu was missing.

Greetings
Kai

Any way to bring back the Manual Temperature Scale adjust? I think it is one of the most useful feature provided by the menu hack trick.

[terriblebmx]

Hey guys i got one for ya 

I recently purchased an E4 with firmware 1.xxv installed ( i forgot which firmware exactly it was)
I upgraded to 2.3 no problem with flir tools.
After following the tutorial to get the hack done on this firmware version with link provided here http://fubar.gr/wp-content/uploads/2015/03/FLIR_E4_2.3.0_hack.zip
I can't seem to get past the 550 error that keeps showing up after the python commands.
I tried to manually delete the common_dll.dll file but even that I can't do, so I renamed the common file as common.good and uploaded the hacked common file with the old common files name in place. I go to turn on the camera and it just stayed on the flir loading screen.
I renamed the original common file back to how it was and it comes on no problem but I still can't get to E8 specs.
Anything I can try doing? I'm out of ideas and it's past 3 in the morning over here. 
Thanks for any input! Good night !

[peperoca]

Can you try to re-flash the firmware from a Windows machine ?
I'm assuming you're not in the USA, right ? There are no export / import regulations for the FLIR E4, that's why FLIR limited it to 9fps, so they can avoid the regulations. The E40 (60fps) has export regulations.
FLIR will cover a firmware upgrade issue under warranty( I only paid shipping to their center for a failed firmware upgrade ). The turn-around time was less than 1 week.

Hi Signal32, thanks for the tip. Unfortunately it didn't work, however been in the situtation I was I gathered different tips from this same thread and managed to get it working. My camera started with the flir logo and dissolved to black, but could connect to it with filezilla.

This is the step by step:
TIC: Flir E5 - Last working firmware 2.3  While trying to update to 2.11 with flir tools on Mac.
Computer to fix: Win 10 x64

1.- With flirinstallnet run RNDIS temporary.
2.- Dissable all network connections and set the IP of the flir ethernet adapter to 192.168.250.1 subnet mask 255.255.255.0
3.- Unrar the 2.3 official .fif to see the contents, specially the FlashBFS folder
4.- Connect with filezilla (anoymous worked, with user and pass didn't).
5.- Load the complete FlashBFS on to the camera.
6.- Disconnect and hard reset it.
7.- Power on - Came on and actually started the firmware upgrade.

I don't have a clue why did it work... And this weren't my ideas, I was just desperate to test anything.

I now must hack it to set it free... 

Thanks everyone for the ideas and replies.

[terriblebmx]

hey back again guys, next step to my previous post was to manually place the resolution files on my flir e4 in a vitual machine with win7 32bit. I had 64bit when I tried the other night. For whatever reason both machines with python 2.11 installed I still get this 550 error using python CMD's.
When I manually do it its like the file is secured so that it can not be deleted, cam on or off.
I have no problem deleting the config file and replacing that, common is the only one giving me issues to replace.



should I try to update from 2.3 to 2.11? I've read 2.11 is a hit or a miss but for 2.3 it was certain. 

[Signal32]

When I manually do it its like the file is secured so that it can not be deleted, cam on or off.

Try to rename it to common_dll_old.dll, instead of deleting it and then copy over the new common_dll in it's place.

[terriblebmx]

Try to rename it to common_dll_old.dll, instead of deleting it and then copy over the new common_dll in it's place.

Thanks Signal32, I tried this in my previous post and just did it again now redoing the RNDIS process, and executing all commands as administrator. I renamed the original file as common.dll.dll.old and uploaded the 1kb common.dll.dll file but the camera starts up and stays in boot mode.



any other ideas?

[Signal32]

I renamed the original file as common.dll.dll.old and uploaded the 1kb common.dll.dll file but the camera starts up and stays in boot mode.
any other ideas?

What does the underlined part mean exactly ? There shouldn't be any 1kb file named exactly "common.dll.dll", with no other extra extension.

Here's exact steps that you can try.
Re-flash 2.3 again.
Rename common_dll.dll to common_dll_old.dll
Copy common_dll_old.dll to common_dll.dll (now you will have 2 identical files one named common_dll.dll and the other common_dll_old.dll )
Run the python script.

[terriblebmx]

the 1kb common_.dll.dll file is from the hacks resolution folder downloaded somewhere in this black hole lol
its actually 37 bytes total compared to the original which is like 1.16mb, seems like the hacker took alot of data out 
I have the original 1.2 firmware saved as well but Ill re flash the 2.3 back in 

[Signal32]

the 1kb common_.dll.dll file is from the hacks resolution folder downloaded somewhere in this black hole lol
its actually 37 bytes total compared to the original which is like 1.16mb, seems like the hacker took alot of data out 
I have the original 1.2 firmware saved as well but Ill re flash the 2.3 back in 

There is no "common_dll.dll" 1kb file, there is a "common_dll.dll.e6" file.
This file is not a replacement for the "common_dll.dll", it just happens to have a similar name, it is a text file with info in it, not a .dll.
If my previous post doesn't work for you, zip up your 1MB common_dll.dll, upload it here and I will try to modify it for you so you can just upload it over and have it work.

[terriblebmx]

There is no "common_dll.dll" 1kb file, there is a "common_dll.dll.e6" file.

really?? then idk what I downloaded because my zip folder has the flirresshack folder with :



i have no common_dll.dll.e6

i was taking the common_dll.dll.delta file and renaming it to common_dll.dll and replacing the original with this one.
well i tried but no success  i have here the uploaded file: pass is eevblog

http://www.filedropper.com/common

[Signal32]

i was taking the common_dll.dll.delta file and renaming it to common_dll.dll and replacing the original with this one.

Ok, I thought you were doing the menu hack, that one has the common_dll.dll.e6 file.
If you're doing the reshack, then yes, the "common_dll.dll.delta" is there, but same thing applies, it's a text file with info, not a replacement for "common_dll.dll"
I'll have a look at your dll.

[Signal32]

well i tried but no success 

What was the issue, how did it fail ? Also, I need your FlashFS\system\appcore.d\config.d\conf.cfc

[terriblebmx]

well i tried but no success 

What was the issue, how did it fail ? Also, I need your FlashFS\system\appcore.d\config.d\conf.cfc

It failed with the python CMD and it generated a 550 error file not accessible.

also the other thing is I dont have a conf.cfc ?  "In FlashFS\system\appcore.d\config.d\" I have a conf.cfg
The extension is a cfg not a cfc. Will it matter? I'll send it over now though

http://www.filedropper.com/conf

[Signal32]

The extension is a cfg not a cfc. Will it matter? I'll send it over now though

OK I see what's happening now. If you indeed only have the conf.cfg then the 2.3 hack won't work for you. Here is why:

Early v1.xxx had un-encrypted config files (conf.cfg), however the v2.3 has encrypted config file(conf.cfc). The hack works by modifying this encrypted file. Since your file is not encrypted, it looks like you still have the old config file from the previous v1.xxx that you upgraded from. The 2.3 hack can not work with this. I haven't seen this situation before, maybe someone else can whey in.

If no one has better suggestions, here is what you can try:
- Try to apply the old, conf.cfg -based hack that was originally made for the early 1.xxx versions, you will have to search back in this thread
OR, even less likely to work: Delete your conf.cfg and file and upload a conf.cfc file in that directory, from someone who already hacked their v2.3
You should wait for better suggestions as the above ones may brick your device, especially the 2nd one.

So basically seems that upgrading from early v1.xxx versions to v2.3 and then trying to apply the hack is not supported.

[Signal32]

The extension is a cfg not a cfc. Will it matter? I'll send it over now though

Found someone with the same issue as you (unless it actually is you ) -- see below.
Since they mention that the resolution hack kept when upgrading from 1.x to 2.3, I think there's a high chance that a modified config file will work for you.
So, revert all changes if you have any (or re-flash v2.3) and then overwrite via ftp your conf.cfg with this conf.cfg (password: eevblog) http://www.filedropper.com/conf_1
Let us know if that works

[mct75]

While the experts are awake I will chime in with my issue.  I had a factory 2.11 camera that I got used with 2.3 on it, reshack applied and ROC present.   Thanks to 2lps I was able to upgrade to 2.11 with reshack and no ROC, but I have never been able to get the full menu hack to work. 

I have center spot/hot spot/coldspot/no measure but not 3 spots or anything else.  For palettes I have Iron/Rainbow/Gray/above thresh/below thresh but not arctic or the white hot/black hot.  I have PIP and blend, but no zoom.  It's like a half-menu-hacked camera.  I've tried running the  2.3.0_Menu.fif a few times, and have played with my conf.cfc/cfg many times.  Not sure where to go from here.

Here's my conf.cfg (decrypted with my SUID)

Code: [Select]

#
# Generated at 2014-04-03 12:58:16
#
.caps entry
.caps.config entry
.caps.config.name text "app E4"
.caps.config.revision text "1.2"
.caps.config.image entry
.caps.config.image.framegrab entry
.caps.config.image.framegrab.fusion entry
.caps.config.image.framegrab.fusion.enabled bool true
.caps.config.image.framegrab.fusion.pip entry
.caps.config.image.framegrab.fusion.pip.enabled bool true
.caps.config.image.framegrab.fusion.hcf entry
.caps.config.image.framegrab.fusion.hcf.enabled bool true
.caps.config.image.services entry
.caps.config.image.services.store entry
.caps.config.image.services.store.enabled bool true
.caps.config.image.services.store.radiometric entry
.caps.config.image.services.store.radiometric.enabled bool true
.caps.config.image.services.store.incompatible entry
.caps.config.image.services.store.incompatible.enabled bool false
.caps.config.image.services.store.incompatible.level int32 0
.caps.config.image.settings entry
.caps.config.image.settings.enabled bool true
.caps.config.image.settings.IRwidth int32 320
.caps.config.image.settings.IRheight int32 240
.caps.config.image.sysimg entry
.caps.config.image.sysimg.alarms entry
.caps.config.image.sysimg.alarms.enabled bool true
.caps.config.image.sysimg.alarms.measfunc entry
.caps.config.image.sysimg.alarms.measfunc.enabled bool true
.caps.config.image.sysimg.alarms.measfunc.maxCount int32 5
.caps.config.image.sysimg.alarms.humidity entry
.caps.config.image.sysimg.alarms.humidity.enabled bool  true
.caps.config.image.sysimg.alarms.humidity.maxCount int32 3
.caps.config.image.sysimg.alarms.insulation entry
.caps.config.image.sysimg.alarms.insulation.enabled bool  true
.caps.config.image.sysimg.alarms.insulation.maxCount int32 3
.caps.config.image.sysimg.irMarkers entry
.caps.config.image.sysimg.irMarkers.enabled bool  true
.caps.config.image.sysimg.irMarkers.spot entry
.caps.config.image.sysimg.irMarkers.spot.enabled bool  true
.caps.config.image.sysimg.irMarkers.spot.maxCount int32 5
.caps.config.image.sysimg.irMarkers.arrow entry
.caps.config.image.sysimg.irMarkers.arrow.enabled bool  true
.caps.config.image.sysimg.irMarkers.arrow.maxCount int32 5
.caps.config.image.sysimg.irMarkers.box entry
.caps.config.image.sysimg.irMarkers.box.enabled bool  true
.caps.config.image.sysimg.irMarkers.box.maxCount int32 5
.caps.config.image.sysimg.measureFuncs entry
.caps.config.image.sysimg.measureFuncs.enabled bool true
.caps.config.image.sysimg.measureFuncs.diff entry
.caps.config.image.sysimg.measureFuncs.diff.enabled bool  true
.caps.config.image.sysimg.measureFuncs.diff.maxCount int32 5
.caps.config.image.sysimg.measureFuncs.diff.calcMask int32 65526
.caps.config.image.sysimg.measureFuncs.isotherm entry
.caps.config.image.sysimg.measureFuncs.isotherm.enabled bool  true
.caps.config.image.sysimg.measureFuncs.isotherm.calcMask int32 20
.caps.config.image.sysimg.measureFuncs.isotherm.dual bool  true
.caps.config.image.sysimg.measureFuncs.isotherm.fixScale bool  true
.caps.config.image.sysimg.measureFuncs.isotherm.interval bool  true
.caps.config.image.sysimg.measureFuncs.isotherm.invInterval bool  true
.caps.config.image.sysimg.measureFuncs.isotherm.maxCount int32 5
.caps.config.image.sysimg.measureFuncs.mbox entry
.caps.config.image.sysimg.measureFuncs.mbox.enabled bool  true
.caps.config.image.sysimg.measureFuncs.mbox.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mbox.maxCount int32 5
.caps.config.image.sysimg.measureFuncs.mcircle entry
.caps.config.image.sysimg.measureFuncs.mcircle.enabled bool false
.caps.config.image.sysimg.measureFuncs.mcircle.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mcircle.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.mline entry
.caps.config.image.sysimg.measureFuncs.mline.enabled bool false
.caps.config.image.sysimg.measureFuncs.mline.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.mline.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.reftemp entry
.caps.config.image.sysimg.measureFuncs.reftemp.enabled bool  true
.caps.config.image.sysimg.measureFuncs.reftemp.calcMask int32 1924
.caps.config.image.sysimg.measureFuncs.reftemp.maxCount int32 1
.caps.config.image.sysimg.measureFuncs.script entry
.caps.config.image.sysimg.measureFuncs.script.enabled false
.caps.config.image.sysimg.measureFuncs.script.maxCount int32 0
.caps.config.image.sysimg.measureFuncs.spot entry
.caps.config.image.sysimg.measureFuncs.spot.enabled bool true
.caps.config.image.sysimg.measureFuncs.spot.calcMask int32 514
.caps.config.image.sysimg.measureFuncs.spot.maxCount int32 5
.caps.config.image.sysimg.visualMarkers entry
.caps.config.image.sysimg.visualMarkers.enabled bool  true
.caps.config.image.sysimg.visualMarkers.spot entry
.caps.config.image.sysimg.visualMarkers.spot.enabled bool  true
.caps.config.image.sysimg.visualMarkers.spot.maxCount int32 5
.caps.config.image.sysimg.visualMarkers.arrow entry
.caps.config.image.sysimg.visualMarkers.arrow.enabled bool  true
.caps.config.image.sysimg.visualMarkers.arrow.maxCount int32 5
.caps.config.image.sysimg.visualMarkers.box entry
.caps.config.image.sysimg.visualMarkers.box.enabled bool  true
.caps.config.image.sysimg.visualMarkers.box.maxCount int32 5
.caps.config.image.contadj entry
.caps.config.image.contadj.minSpanFactor entry
.caps.config.image.contadj.minSpanFactor.enabled bool true
.caps.config.image.contadj.minSpanFactor.factorAuto double 2.0
.caps.config.image.contadj.minSpanFactor.factorManual double 2.0
.caps.config.image.targetNoise entry
.caps.config.image.targetNoise.enabled bool true
.caps.config.image.targetNoise.targetNoiseMk int32 0
.caps.config.image.zoom entry
.caps.config.image.zoom.enabled bool  true
.caps.config.image.zoom.maxFactor double 8
.caps.config.system entry
.caps.config.system.focus entry
.caps.config.system.focus.laser entry
.caps.config.system.focus.laser.updateFocus entry
.caps.config.system.focus.laser.updateFocus.enabled bool false
.caps.config.ui entry
.caps.config.ui.image entry
.caps.config.ui.image.adjust entry
.caps.config.ui.image.adjust.enabled bool  true
.caps.config.ui.image.adjust.manual bool  true
.caps.config.ui.fusion entry
.caps.config.ui.fusion.PIP entry
.caps.config.ui.fusion.PIP.enabled bool  true
.caps.hw entry
.caps.hw.sdcard entry
.caps.hw.sdcard.enabled bool   false
# ID [removed]
# CRC03 [removed]
‚3¡Ù*Ê`öÏY1Þ
í@7ŽZcËÍ÷¾ïD*Iu/öŸ$—5Ý@Êÿ»MkòÖ
Š\°¸“:7}Ú²‡iÀC*TçEÍÖ@ZÔÐÍÙ»pI¢—/‡¿qmx;èôž¯[p.á ¤‰¹[Ð@¹)NÃ*.Ÿoʍ×ÔC›À ònm^A¼Ê,#eÈüfO‘ZP%Fá]

[terriblebmx]

I GOT IT WORKING !!!!!!!!!!!!!!!!!!!!!!!  O0

Okay so from the start when I recieved my E4 I noticed it had the v1.(something) firmware installed.
I downloaded flir tools from their website and when connected, I was prompted to upgrade to v.2.3 which I did.

(skipping the attempted fails)

I downloaded the CRC01 files uploaded by taucher here:
https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg332090/#msg332090

I followed the instructions within the CMD window and at the finale I generated a .fif file.
According to the instructions I was supposed to install the .fif file through the flirnetwork tool but it was denied as an illegal file.
So I went into the directories of the generated fif and manually replaced the original conf.cfg in my camera with the generated cfg file named e8.cfg using filezilla. Unplug the usb cable, turn off, remove battery, reinsert battery and turn on.
Waalaaaahhh I had E8 specs on my E4. I did not have to replace the common_dll.dll file or do anything with it.
This upgrade only worked for the resolution. I will attempt menu upgrade at another time but all is good now.
Thank you signal32 for putting me into the right direction. 



^ it actually looks better than the picture provided. Output picture looks a little compressed to me compared to live.
Also with older firmware the FLIR logo stays with the CRC01 upgrade compared to the v2.3.

[gotrice]

my Flir E4 just arrived, it came with software 2.11 and model 1.2L. i cant exactly find a guide to hack it with software 2.11. do i have to downgrade the software, just like for version 2.8? i did noticed a few people have been successful hacking software 2.11...

if someone can help me with a step by step guide to hacking my E4 it would be greatly appreciated. thank you

hey, i will gladly pay someone to help/guide me in hacking my e4... there is't really a step by step guide for firmware 2.11, so i don't want to mess around and  brick my new precious camera . thank you

[Dynamics]

gotrice:

What operating system are you running on? Did you install Flir drivers? Did you install Flir Tools? Did you install python and then restart? Download the 2.11.0 custom hack ZIP provided by user 2lps and extract those 3 folders into your root C:\ directory. Can you get this far? Where are you getting confused?

[2lps]

Here is my decrypted conf.cfc for 2.11. It has all the menu hack options. If someone wants to try it, just put your ID and CRC03 at the bottom, instead of the xxxxxxxx. There is an empty row at the end, which you need to preserve. Then use cfccfg_V2 to encrypt it (cfccfg_V2.py <put your SUID here> conf.cfg conf.cfc) and copy it to the camera. Then do a hard reset.

[peperoca]

Finally I got my E5 FW2.3 hacked.

The reshack worked like a charm with the CRC03 and ftool decryption and encryption method, but the menuhack got me working. I now have a vast range of new options including zoom but I'm missing the manual temperature scale, only have the auto and lock option.

I've used the guide and archives for the menuhack from a message of janekivi (https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg577970/#msg577970)

Thanks for this important source of knowledge.

[Dynamics]

Sweet dude, enjoy your newly valued $4000 instrument =D

[peperoca]

Does anyone know how to get the manual temp scale on the menus?

Thanks again

[Signal32]

Does anyone know how to get the manual temp scale on the menus?

Allegedly yes: http://www.ebay.com/itm/-/291804070356
"New-In-Box with calibration certificate dated May 2016" (implying firmware 2.11)
"Temperature Scale:
Auto
Manual (set upper temp, lower temp or shift both + or -)"

It might also be possible that he copy-pasted over the alleged hacks from a previous firmware-version hack and didn't double check that the manual temp scale is there. Or it might just be that it's downgraded to 2.3 and he's hoping you won't hit the ROC issue.