Flir E4 Thermal imaging camera teardown

[Fraser]

Such thermal investigation would be a challenge as the temperature differential inside the Micro-bolometer FPA is intentionally very small. The sensing elements do not produce heat. The resolution of the FireFlIR (320x240) is also too low for die detail, even when using a close-up lens.

[tesla500]

Such thermal investigation would be a challenge as the temperature differential inside the Micro-bolometer FPA is intentionally very small. The sensing elements do not produce heat. The resolution of the FireFlIR (320x240) is also too low for die detail, even when using a close-up lens.

Yes, but you could potentially hold a "light" (soldering iron?) over it and see differences in thermal reflectivity on the microbolometer.

[mikeselectricstuff]

Next time I have it apart, I will try with a halogen lamp

[mamalala]

Next time I have it apart, I will try with a halogen lamp

If needed, i can send you a 600W HPS plus ballast. That should give you enough heat and light 

Greetings,

Chris

[Fraser]

I found an interesting and enlightening document on Microbolometer design that had Inframetrics input. I have placed it under its own heading here:

https://www.eevblog.com/forum/projects/thermal-imaging-camera-microbolometer-design-detail/msg312455/#msg312455

Fraser

[mikeselectricstuff]

How exactly did you get the serial boot data off of the E4? Which pins, and with what PC adapter? Which serial format was it in?

38K4 baud on a pin on the unused FFC connector - I've not had time yet to figure out all the pins, but I2C, CPU reset and power button are on there.

[mikeselectricstuff]

Pins I know so far - all I've done so far is test for input/output using pullup/pulldown resistor
 4 & 6 look good candidates for serial in.
Logic levels are 3.3v
Starting from end nearest to the unpopulated FFC connector
1 On/Off switch (to ground)
2 Power - Vbattery during run and charge - possibly via a FET switch as I didn't see continuity to bat terminal
3 Output
4 Input
5 Serial TXD 38K4
6 Input
7 0V
8 /Reset
9  Output
10 Input
11 Output
12 Input
13 Input
14 I2C SDA
15 I2C SCL
16 0V

[mikeselectricstuff]

Someone emailed me last week with info on hacking the i series but was very wary of releasing - apparently there is a power-up key combination that gets you into a config screen, from which you can enable networking and do stuff like changing the resolution of i3 to i7, disabling the text overlay and reducing display noise - don't have it to hand ATM but I think it was something like holding play+down key at startup.

[BravoV]

Damn, this is getting intense, sub'd, thanks Mike ! 

[Pinkus]

Edit: wrote I4 accidentely - I now corrected it to I3.

OHHHHH - if hacking an I3->I7 would be possible, I would purchase a I3 right away.
I doubt that hacking could be so unbelievable easy but  if Mike confirms during the weekend that there is a keyboard combination for enhancing resolution to 140x140 I am going to order one on monday.

The decision would be the same for me as with the Rigol product: only because of the available hacks I purchased DS2072 & DSA815-TG & DG4062: I am willing to spend some money for decent functionality but price/functionality- relation has to be a really good one.

[mikeselectricstuff]

Edit: wrote I4 accidentely - I now corrected it to I3.

OHHHHH - if hacking an I3->I7 would be possible, I would purchase a I3 right away.

Might be worth waiting to see what's possible on the E4, unless i3's are being heaviliy discounted. And no, I don't know anything yet before you ask, but haven't started seriously looking yet. 

[mikeselectricstuff]

Maybe worth splitting i-series discussion to a different thread to avoid confusion?

[Fraser]

We could almost do with a Thermal camera section on its own....there is a lot of interest in these units and mush fun to be had with them 

I thought about starting a thread that will contain pictures taken of electronics using such units to show what is possibkle with teh different models and resolutions.

I would support the i series hacking or investigations being in a separate thread to avoid too much criss crossing within the flow of conversations.

I feel sure that there will be many interested in the whole range of topics and Mike has already proven that many wish to know what 'magic' goes on inside the modern TIC.

All very interesting and informative stuff 

[amyk]

At a glance there are a ton more DMM and scope threads than TICs, and they don't get their own section...

[Fraser]

But DMMs and scopes are BORING in comparison ! 

[mikeselectricstuff]

So if you hold the 'load' button down during startup.....

Bootloader 16.3 for ASCO (May  6 2013 11:41:42)
PMIC wake up: R5=40h E_SEQ_RDY  R6=1h E_nONKEY
PMIC status:  R1=1h nONKEY  R2=a0h COMP_DET GP_FB2
Fuel gauge check: res=1, voltage=3704
Reset reason (0x00000000): Power ON

Press [ENTER] to force OS/FS image update (MSD) or [SPACE] to cancel.

Initiating image update in 0 seconds.
Launching flash image  ...
+InitSpecifiedEthDevice
INFO: Trying to initialize the built-in USB/MSD...
MSD:: initialization
MSD: USB initialization completed

..and if you then plug it into the PC

USB Attach: High speed

Appears as a drive, but just a couple of uninteresting text files - probably looking for a firmware file to be saved

[mikeselectricstuff]

..and if you send a <space> to the UART during boot....
<quote>
SETTINGS:
0) IP address: 0.0.0.0
1) Subnet Mask: 0.0.0.0
2) Boot delay: 1 seconds
3) DHCP: Enabled
4) Reset to factory default configuration
5) Autoboot: NK from NOR
6) MAC address: 00:40:7F:0B:91:39
7) Host connection: (USB MSD)

ACTIONS:
S) Save configuration
D) Download image now
L) Launch existing flash image now
R) Launch existing flash image now in SAFE (restricted) mode
E) Erase flash file system area
B) Erase OS Image area
</quote>
Option 7 may be intersting - options are USB BSD, ETHERNET and USB RNDIS, which provides virtual ethernet over USB - fairly sure the latter is what enabled the i7 hack - unfortunately I've lost the email I had about that.
Safe mode doesn't do anything interesting

[Fraser]

Oh Mike.....you LOST the hack email   

Or did you hear the distinctive thump-thump-thump of the black helicopters rotors overhead ? 

If you ask GCHQ or the NSA nicely, they may provide you with their copy of the email 

[mikeselectricstuff]

Oh Mike.....you LOST the hack email   

Or did you hear the distinctive thump-thump-thump of the black helicopters rotors overhead ? 

If you ask GCHQ or the NSA nicely, they may provide you with their copy of the email 

Yep - hard disk on that laptop was failing around the time I got it - have tried to recover but no joy so far - may still be in there somewhere..

However.....
If you download the Ex firmware from Flir, and rename the .fif file to .cab  Many very interesting things appear.... Will take some time to examine....

[mikeselectricstuff]

This looks interesting....

Restarting in high resolution mode/service mode

[amyk]

Especially after seeing those erase options I hope you've dumped the flash image and stored it in a safe place for backup... for recovering from any accidental bricking. One of the first things I do when RE'ing a device is try to get a complete firmware image.

[Fraser]

Ahhhh, the infamouse computer hard disk crash..... what you have to ask yourself is.....did it just 'die' or was it Killed by the Dark Net 

With regard to the proding of the firmware in your camera.  A back-up would be prudent if possible as from what I have learn't each camera is calibrated, and the calibration data is vital to correct image appearance. My PM570 has this important Microbolometer calibration data on the same Flash chip as the OS firmware. It uses a block addressable 28F16 for all its Flash storage needs.

[mikeselectricstuff]

oooh look - I found another serial port...

Code: [Select]

List of all available commands (+ description)

  command /?     For more information on a specific command

?        List all available commands without description).
ALIAS    Sets, removes or shows aliases.
ATTRIB   Displays or changes file attributes.
BEEP     Beep the speaker.
CALL     Calls one batch program from another.
CD       Displays the name of or changes the current directory.
CHOICE   Waits for the user to choose one of a set of choices.
CLS      Clears the screen.
CMD      Starts a new instance of the FLIR command line interpreter.
COPY     Copies one or more files to another location.
DATE     Displays or sets the date.
DELETE   Deletes one or more files.
DIR      Displays a list of files and subdirectories in a directory.
ECHO     Displays messages, or turns command echoing on or off.
ERASE    Deletes one or more files.
EXIT     Quits the CMD.EXE program (command interpreter).
FOR      Runs a specified command for each file in a set of files.
FREE     (free) disc space.
GOTO     Directs the FLIR command line interpreter to a labeled line in
         a batch program.
HELP     Provides Help information for FLIR commands.
HISTORY  List all commands which has been used
IF       Performs conditional processing in batch programs.
MD       Creates a directory.
MKDIR    Creates a directory.
MOVE     Moves one or more files from one directory to another
         directory.
PATH     Displays or sets a search path for executable files.
PAUSE    Suspends processing of a batch file and displays a message.
POPD     Restores the previous value of the current directory saved by
         PUSHD.
PROMPT   Changes the command prompt.
PUSHD    Saves the current directory then changes it.
RD       Removes a directory.
REM      Records comments (remarks) in batch files.
REN      Renames a file or files.
RENAME   Renames a file or files.
REPLACE  Replaces files.
RMDIR    Removes a directory.
SCREEN   Move cursor and optionally print text.
SET      Displays, sets, or removes FLIR command line interpreter environment va
riables.
SHIFT    Shifts the position of replaceable parameters in batch files.
START    Starts a separate window to run a specified program or command.
         Executes command.
TIME     Displays or sets the system time.
TIMER    Allow the use of ten stopwatches.
TYPE     Displays the contents of a text file.
VER      Displays the FLIR command line interpreter and Windows CE version.

\>

[Fraser]

Entry point into the command line for the Embedded Win CE computer ?.
Now how to extract and edit the boot batch files to change some settings 

[mikeselectricstuff]

Looks like a boot filesystem and a 'working' one. Tons of config/cal data. Looks like model assignment may be baked into the cal process to some extent.

Looking to see if I can copy files between the flash Filesystem and the filesystem that's visible through the USB. Any 
CE experts out there?