I had a bit of trouble finding all the right information for an older firmware, so I thought I'd just document what worked for me while it's fresh.
Camera info:
Model: E4 1.1L
Serial: 6392 1xxx
Software (initially): 1.22.0
I upgraded to the latest software 3.16.0 using FLIR Tools.
The secret menu (hold right for 10s in camera info menu) comes up but changing USB mode would never apply, so instead I used Flirinstallnet.exe and Set_RNDIS_Permanent.fif to enable RNDIS mode.
The camera came up with IP 192.168.250.2 (not 192.168.0.2) and I backed up everything over FTP.
For generating the new conf.cfc lots of posts suggested the cfccfg_V2.py script, but that did not work for me on 1.1 firmware (MSX broke, suggesting the conf was bad). I needed to use the older ftool which I got from here:
https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/?action=dlattach;attach=84664 . I'm on linux so I just built it from the source in that zip after renaming a few files for case sensitivity: `g++ -o ftool *.cpp`.
I used `ftool -d <backup/conf.cfc> conf.cfg` to decrypt my backed up config and retreive the two SUID values & the ID to add at the end of the config. I also built the CRC03 tool and generated that, but I don't think that was actually necessary with the patched DLL used later. With the conf.cfg from the basic package below, I used `ftool -e conf.cfg conf.cfc 0x1234 0x5678` (replacing with SUID values gained earlier).
I could then follow the instructions from the basic package at:
https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg1397359/#msg1397359 but replacing the dll with the one here:
https://www.eevblog.com/forum/thermal-imaging/flir-e4-wifi-resolution-and-menu-hack-thread/msg2252082/#msg2252082. I also modified the conf.cfg revision entry text from '2.0' to '1.1' but, again, not sure if that was necessary.
Many thanks to everyone involved, and I hope this helps someone!