Flir E4 Thermal imaging camera teardown

[Spirit532]

Does the sensitivity changing after e4 hack?
And how to check whether it has changed?

There is a setting in the config file called "targetNoise" - disable it(true to false) and set the target to 0.
It's an artificial noise generator used by FLIR to purposefully hinder the sensor's performance on lower end models - it's even enabled on the E60, just to a lesser degree!

The actual sensitivity of the sensor has been measured by other users to sometimes fall under 25mK(0.025C).

[dedelekid]

just in case if my message was not read ..

Can someone post this files "T559504%24A.pdf" T559504$A.pdf , if they still had in his archives? thank you.
it will give me a bit of reading .........

[Fraser]

I know what that document is, but others may not recognise it by the cryptic FLIR file title. From memory it is a document relating to the ''A" series cameras that detailed the Console commands.

Sadly I cannot find my copy of that document at the moment. Try asking again, but using its document name. You may get a better response.

Fraser

[dmendesf]

Did as following:

cfccfg_V2.py 1151d50200581c2b conf.cfc conf.cfg

cfccfg_V2.py 1151d50200581c2b conf.cfg conf2.cfc

uploaded conf2.cfc to camera. Didn´t work (of course I renamed it conf.cfc). Did a diff of the 2 files... there´s a bunch of differences at the end ( Think 128 bytes of conf.cfc turned into zeros in conf2.cfc).

Ok, so I had a great idea... let´s make a conf2.cfg from conf2.cfc and spot the differences! There were none 

Then I noticed that the cfg files are smaller then the cfc ones... so it´s not a classical encryption/decryption were 1 byte goes in and 1 byte goes out.

I think I probably made a mistake at the DLL edit. I´ll do it again. If it doesn´t work i´ll search for the CRC03.

Your new config is not getting loaded for some reason, that is why you observing that result.

Try encrypting the original cfg file back with no changes, see if the camera works same way as with the original cfc. This is to test if your encryption works and if the modified common_dll works.

Try adding a proper CRC03.

Try leaving the camera with no battery overnight.

BTW make sure you only have one cfc file in the folder.

[Bud]

Did a diff of the 2 files... there´s a bunch of differences at the end ( Think 128 bytes of conf.cfc turned into zeros in conf2.cfc).

Ok, so I had a great idea... let´s make a conf2.cfg from conf2.cfc and spot the differences! There were none 

Then I noticed that the cfg files are smaller then the cfc ones... so it´s not a classical encryption/decryption were 1 byte goes in and 1 byte goes out.

This behaviour is expected. This is the way the python script works. This all looks OK.

I think I probably made a mistake at the DLL edit.

Yes your DLL was not done right or not transferred to the camera correctly. Download you current DLL from the camera and see if that was the one you uploaded before.

[dmendesf]

I did again the DLL edit and upload. Nothing changed. Then I found the CRC03 program, used it to update conf2.cfg. made a new conf.cfc from it and uploaded again. Still the same result. I´ll return with the old DLL now (as now I have a conf.cfc with good CRC03) and see what happens... i´m running out of options. I´d like to compare my files with other known to work ones.

EDIT: returned with old DLL, nothing changed. No clue about what to do now.

This behaviour is expected. This is the way the python script works. This all looks OK.

I think I probably made a mistake at the DLL edit.

Yes your DLL was not done right or not transferred to the camera correctly. Download you current DLL from the camera and see if that was the one you uploaded before.

[Bud]

How you upload the DLL ? Typically you need to run appstop stopapp in Telnet before you upload it.  Have you checked what you have on the camera is what you have uploaded ?

[dmendesf]

This is new information to me. No, I didn´t check, just put it there. will look for the syntax of appstop and try this... Thanks again. 

EDIT: search returned no hits for appstop. Are you sure this is the name of the command?

EDIT: found it, it´s stopapp Will try tomorrow. Found some other ideas to try.

How you upload the DLL ? Typically you need to run appstop in Telnet before you upload it.  Have you checked what you have on the camera is what you have uploaded ?

[dmendesf]

EDIT : VICTORY!!!! 

See attached image....

Read back common_dll and noticed that it wasn´t modified. Used stopapp, uploaded again, downloaded again.. now it changed. (file date also changed... it´s a good indication if the update really ocurred). Camera reboot... and now it works. Thanks for all that helped me thru it, especially Bud.

Now it´s time for menu hack 

[Bud]

Yah baby, now we' talking!
 

[dmendesf]

Started studying menuhack... Tried as described here:

http://fubar.gr/hacking-the-flir-e4/

Noticed that it patches conf.cfc at a fixed offset. Will this work with my conf.cfc with unusual size? I think that it´s not a good idea... Maybe I need to manually decrypt it, copy the relevant parts, encrypt again... what do you think?

EDIT: Tried it anyway, camera got screwed up like when common_dll wasn´t patched... Will restore to previous state...

RE-EDIT: Camera restored to resolution hack only.... will study how to apply menu hack manually... pointers are welcome

[Bud]

Search this thread backwards for the last post from user  janekivi which has 2.3.0 menu update package. Unarchive and manually copy the files to your camera. I am not a fan of automated scripts, they too often screw things up.

[dmendesf]

Thank you again... found it:

https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg577970/#msg577970

Manually applied all patches and now I have plenty of new menu options

Search this thread backwards for the last post from user  janekivi which has 2.3.0 menu update package. Unarchive and manually copy the files to your camera. I am not a fan of automated scripts, they too often screw things up.

[Bud]

Enjoy! 

[kulu22]

Hi guys,
First of all, sorry for my english. This post is hardware related, and I hope it will help some members. I bought an E4 with broken (missing) USB and defected display from Ebay. As I know, the USB problem is common with these devices. Repairing this by Flir is pretty expensive (in my case ~ 50 + 50 EUR for shipping and ~ 250EUR for inspection + VAT, but the cost of inspection will be deducted from the final repair cost), comparable to price of a used unit. So I decided try to fix it by myself.
After disassembled the E4 (thanks to Mike's video), I saw that the edge of USB driver is broken and the pins of this chip are shorted by sloldering material. Not too good news.
In the first round I cleaned the damaged area and placed a new USB connector on PCB. Huh, it's a quite task. Unfortunately after this, the E4 still not communicated with the PC. After browsing some datasheets I found a Microchip device that has similar pinout like PCB pattern. I ordered it and replaced the broken one. And voila, everything works now. I can charge by USB and the device is visible from PC.
The chip type is USB3751A-2-A4-TR in a QFN16 case.
 

[thedamner]

I wanted to say thank you to all the work you guys have done to help open up these E4's.  I also wanted to post here of what finally worked for the E4 I recently purchased, since there is SOOOOO much information here to sort through.

My camera: PN: 63901-0101, Firmware: 1.21.0.  I was able to put it into RNDIS mode directly from the menu on the camera which helped.  I also initially was following the information here http://fubar.gr/hacking-the-flir-e4/, in hopes it would speed up the process, it didn't: http://fubar.gr/hacking-the-flir-e4/

I spent a great deal of time trying to figure out which firmware to use.  I'm still a bit shaky if there is a working firmware into 2.x that works for these older cameras; however I discovered that anything beyond my 1.21.0 was causing my crosshairs / center spot to vanish, as well as the MSX function  .  However, the resolution hack always worked perfectly, the menu hack using the provided python script failed with an assertion error in the script.

So, after volleying around trying every solution just to even get back my MSX/Crosshairs this process worked perfectly:

Revert back to 1.21.0 and reset factory settings.
Put the phone into RNDIS mode via the menu.
Download the CFC Generator from Stefbeer: https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg411505/#msg411505
Use the Template file provided, turned off the noise in the CFC file, copy the resulting CFC file to the camera.

Download the Beta 3 Menu Hack: https://www.eevblog.com/forum/thermal-imaging/flir-e4-thermal-imaging-camera-teardown/msg326024/#msg326024
Very carefully using FileZilla copy the files to the camera and reboot.

Everything came back perfectly.  Menu hacks and resolution, with the noise down the image is quite striking in comparison to the non hacked version.

More about my caveat with menu hack, and to re-iterate being careful.  Somehow I initially fubarred the upload (seeing files error out threw me off) and tried to restore the files from my backup thinking I'd messed up; I temporarily bricked the camera.  The Flir logo would come up, but after that just black screen.  Flirtools didn't see the camera at all, I didn't know if it was in RNDIS mode or not.  I couldn't communicate with it in FileZilla or get it beyond a black screen.

To fix the bricked camera, at least in my instance I discovered the Telnet connection was still working and FLIRInstallNet.exe could still apparently see the camera.  So, I just loaded up one of the many firmware .fif files I had lying around and ran it.  It updated the firmware on the camera just as it would have if you updated the firmware from within Flirtools.  However, the behavior during the update was totally different.  There was no display on the camera of it copying files or anything but when it was finished FLIRInstallNet asked to reboot the camera; viola it came back to life again. 

In the end I settled on the above process and staying with 1.21.0, but I thought after digging through the forums and toughing out the many update attempts it was worth writing a post in the event anyone else has the same situation, an older E4 and sooooo many posts to search through.

I'd be interested if others already know of other firmware what would officially work on the older camera, if there was a compelling reason (new, better,  menu hack options) but for now the camera is stable, works great and the with the menu hacks I have lots more functionality!

Thank you all again for all this incredible help and please ignore this if you are already an expert here, I'm just writing this for someone in my same situation.

[haef]

My apologies if the answer to this is buried in all this excellent info:

Before I recently became aware of the E30 hack, I was doing a firmware update using FLIR's utility.

The problem is that after the update, the camera now will not complete the startup process.  The progress bar gets to the end and then... sits there.  Camera shows an image, but does nothing else useful.

The only thing I can get it to do is display the version number under the progress bar "FLIR E30 2.23.14*"  Not sure what the asterisk is about.

If anyone has seen this problem and can suggest a cure, I'd sure appreciate hearing about it.  I want to do the hack!
Otherwise, it is going to have to go back to FLIR for service.  And I'm afraid they'll do something that will make it un-hackable in the process of resurrecting it.

Ironically, it was searching around for an answer to this problem that led me to the hacking possibilities.  This is mean.   

[Fraser]

Have you tried repeating the firmware upload starting from scratch with a different SDCard and a fresh copy of 2.23 ?  You did do an SDCard update didn't you and not something via USB ?

Fraser

[haef]

This problem happened a few months ago, and I put it on the shelf due to lack of time.  So going from memory here... 

4 years ago I performed a an update.  I believe the process is what you are alluding to: Download firmware.  Put the firmware on a card, put in camera, use the camera menus to execute the update.  No problem.

This time I used a usb cable hooked to a PC and the Flir tools to perform the update.  I'm fairly sure there wasn't an option to do it the former way, and I believe it was PC Tools job to go retrieve the firmware.  That's how it broke.  There wasn't and still does not appear to be a way to download the firmware.  I need to retry it, but I think the PC Tools cannot find the camera now.

Thoughts?

[haef]

Has anyone here actually bricked their Flir?  Was recovery possible?  I'm not finding much.

FWIW, I see Flir has a new Exx series update:  2.27.15  dated Jan 17, 2018
http://80.77.70.144/SwDownload/app/RssSWDownload.aspx?ID=127

Wonder if that one is hack-proof?

[kaz911]

Has anyone here actually bricked their Flir?  Was recovery possible?  I'm not finding much.

FWIW, I see Flir has a new Exx series update:  2.27.15  dated Jan 17, 2018
http://80.77.70.144/SwDownload/app/RssSWDownload.aspx?ID=127

Wonder if that one is hack-proof?

The Exx series is not the E4 (which is the Ex series) - The Exx series are the bigger thermal cameras.

[Fraser]

The new firmware release for the Exx series is interesting. The update is for the pre 2013 MK1 Exx series camera. FLIR effectively abandoned firmware development for the MK1 Exx cameras when they released the MK2 which uses a different firmware type.

I heard about the update to the firmware recently via another post. The previous 'final release' for the MK1 was 2.23 and that was excellent as it was unencrypted, contained the full service menu, and is open to upgrade. FLIR released a new firmware for the MK1 titled 2.26 in September 2017. Why ? I suspect someone decided it might be time to close the door on the MK1 upgrade route ? Now they have released 2.27 this month. Weird, very weird. Either 2.26 was buggy, or it did not achieve the desired result. I very much doubt FLIR would invest time and money on a new firmware for the MK1 Exx cameras as they are now old and FLIR would wish owners to buy new cameras. This leaves the incentive of blocking the upgrade of the older cameras that would give them a new 'lease of life' for current owners. No need to buy a new, higher resolution camera. All this is total speculation on my part though.

I cannot see a good reason to upgrade from firmware 2.23 to 2.26 or 2.27 as 2.23 is stable, very capable and contains the service menu.

Why am I saying all this on the E4 teardown thread ? Well the Exx series cameras have always shared this thread due to the similarity in the upgrade process and shared firmware. What recent events for the MK1 Exx camera firmware seems to indicate is that FLIR are still diverting resources into potentially making the upgrade of their cameras harder for us.

With regard to bricking a camera....... yes it is definitely possible and whether it is a recoverable situation depends upon what has been done to its file system. No full OS/firmware installation exists outside FLIR so killing critical files that prevent the camera booting normally means a repair fee at FLIR for a full software/firmware rebuild. That rebuild will use the latest firmware version FLIR has available.

Fraser

[haef]

Well it was their upgrade process that hosed mine, so danged if I'm paying them to make it right.  Just sayin'.

So I do that and it comes back with 2.27: Will I be able to roll it back?

I've never quite understood companies that get all wigged out by people hacking on their products.  It gets people engaged with Flir things, and probably barely cannibalizes new sales or upselling.  Sure, it probably creates a better market and longer lives for their used gear and that probably costs them some new equipment sales.  But then they have a bigger installed base and more Flir aficionados.  That's overall a positive thing methinks.

I know I lucked out and found a great deal on an E30... but I was most certainly not going to go out and buy an E60.  But if a business needs an E60, how often is buying and hacking a lesser device really considered an option?

[arrakys]

Hello there,

is there a way to get 640x480 or 800x600 IR final jpg shoot using an (hacked) E4 ?

[Spirit532]

is there a way to get 650x480 or 800x600 IR final jpg shoot using an (hacked) E4 ?

No.
The sensor is 320x240 and the firmware does not allow upscaling.
The best you can do is to set the JPEG quality to 100%.