Flir E4 Thermal imaging camera teardown

[mikeselectricstuff]

Correction : FTP login flir / 3vlig does work, but not on all FTP clients - Windows command line FTP works, FTPsurfer doesn't

BTW flir/IRCAM doesn't work on web interface

[mikeselectricstuff]

Another thing. It would be really interesting (at least for me if not for others also) what would happen if you enable the UVC mode for USB. Does this result in a USB video stream of thermographic video (basically like webcam)?

You can do that with the standard, unmodified product, as mentioned in the review.  Just plug in & it appears as a digital camera device & you can record video. Framerate is a bit messed up but it does work.

[nitroxide]

Oops, my bad! I may have skipped parts of the review... 

[Fraser]

Hey Mike,

Just to let you know that your tear down video and investigation is being watched closely by comapnies in the TIC industry. Three separate technical officers have mentioned it to me recently     You are causing a bit of a stir 

[ixfd64]

If you're going to void the warranty, you might as well go the whole nine yards.

[mikeselectricstuff]

OK Useful-ish Hack stage 1 is achieved.

UART console : usbfn RNDIS

Plug USB into PC (having loaded Flir device drivers from http://flir.custhelp.com/app/account/fl_download_software, PC softare (Thermography) -> device drivers)

Web login to service menu (192.168.0.2) with user flir, PW 3vlig

Enable service mode - reboots camera into service mode (takes about 45 secs)

Some E8 functions now available -Auto hotspot, Auto coldspot, more colour pallettes

Oh, and.....
320x240 resolution

Boot text in service mode

FVD_Init: Downsampling setting: 0x00
FVD_Init: re-read the hardware information x: 320, y: 240

On next  power-up boot :

APPLAUNCHER: Starting usb charge App
ProgressApp expecting 301 events
FVD_Init: Downsampling setting: 320 240
Timeprint (3518)
POST 20131025 00:08:42 -      appcore.exe: Application started
....
POST 20131025 00:08:44 -      appcore.exe: TSFpa: 303.000000 K
FVD_Init: Downsampling setting: 0x00
FVD_Init: re-read the hardware information x: 80, y: 60

Unfortunately sleep/restore doesn't seem to work to keep it in service mode as long as battery connected 

[Fraser]

RESPECT 

[mikeselectricstuff]

Hey Mike,

Just to let you know that your tear down video and investigation is being watched closely by comapnies in the TIC industry. Three separate technical officers have mentioned it to me recently     You are causing a bit of a stir 

I wouldn't expect any less 
Saves them paying for one of those expensive reports from people like Systemplus.

[Fraser]

If you achieve your objective, I predict a very sharp increase in E4 sales ...... FLIR will have a major seller on their hands. I wonder how they will feel about that ?

I am aware that industry will continue to buy the full cost units due to calibration etc, but the E4 would become the cheapest 320x240 on the market and built by a top class manufacturer ! The Consumer TIC Holy Grail.

Very interesting times 

Oh and forget about the black helicopters.... it will be the white van snatch squad from FLIR that you need to worry about. 

[mrflibble]

Well done!   

So basically an old school IP-over-USB + use the telnet/web/whatever interface and you're in service mode? awesome! 

[mikeselectricstuff]

One minor issue is in RNDIS mode you can't get USB access to the drive, but you can get at the files via FTP in net mode - an advantage of this is you can take pics and pull files with USB connected - in normal mode the filesystem can only be mounted by the PC or the camera at any time.

but you can do
usbfn Mass_Storage_Class
via telnet, which reverts it to mass storage ( and dumps the net connection, obviously)

If you only have Telnet, be careful with spelling as any misspelling will dump the RNDIS link but not start MSD

[nitroxide]

That was quick. Good job Mike! 

Have you tried the RNDIS_UVC_MSD mode instead of RNDIS?

On another topic, I've made some good progress on Hidden Service Menu investigation, but I'm too tired to finalize this. If someone wants to give it a try - disassemble facet_ui_qml.dll and search for "hidden" string.

[bean_dip]

Much respect Mike!

I'm still playing around with key combinations...nothing great yet, but while charging if you press "Left" and "Right" at the same time you get charge statistics under the charging icon.  But, this does verify the presence of hidden key sequences.

[mikeselectricstuff]

The only thing stopping this being done without opening the unit is finding the magic way to get to teh hidden menu to enable RNDIS.

..and of course potentially the next FLIR firmware update....

[mikeselectricstuff]

That was quick. Good job Mike! 

Have you tried the RNDIS_UVC_MSD mode instead of RNDIS?

On another topic, I've made some good progress on Hidden Service Menu investigation, but I'm too tired to finalize this. If someone wants to give it a try - disassemble facet_ui_qml.dll and search for "hidden" string.

doesn't seem to work - it won't let me copy or FTP off usbfn.exe to look for strings

[tom66]

OK, the E4 is seriously tempting me...



I expect a hackable E4 would not lead to a significant reduction in E8 sales, but would lead to a large increase in E4 sales to the hobbyist/budget market.

[Pinkus]

Deleted - Sorry, I wrote rubbish .....  its too late now: 1:10 am

[mikeselectricstuff]

http://flir.custhelp.com/app/account/fl_downloads

Software -> PC Software (Thermography) -> FLIR Device drivers -> X86 or x64 as appropriate

You do need to register.

[nitroxide]

Direct link to drivers: http://cdn.cloud.flir.se/swdownload/assets/other/flir_device_drivers.exe
Both x86 and x64 seem to point to the same file - correct me if I'm wrong.

[Pinkus]

I expect a hackable E4 would not lead to a significant reduction in E8 sales, but would lead to a large increase in E4 sales to the hobbyist/budget market.

You bet! I already placed my order. Finally I can check my prototypes about hot spots and heat spreading. A resolution of 80x60 was nothing to write home about, but 320x240 for 1200 Euro (incl. VAT) is fair.... and as I side effect I can check my house for hidden problems.

[mikeselectricstuff]

Just tried a few permutations of sleep mode to see if test mode can be sustained longer term, but it seems to flake out - if plugged int USB it sticks at the battery logo when you wake, if not, it sort of wakes up then crashes.
I suspect cockup over conspiracy on this one....

Of course until we find the secret key or fully hack it, a little PIC/AVR on a flex plugged into the test connector to say "usbfn RNDIS" when it sees the command prompt would do the trick...!

[mikeselectricstuff]

Little snippet from resources when in service mode

.caps.config: (3)
name            "app E4 1.0 + app prodconvconf_std 999.9KaKaOnly"

[mikeselectricstuff]

Update - although manually turning off from service mode crashes it, it seems like if you let the auto-power off time out, it wakes back up in service mode (with  RNDIS still running).
 
Incidentally I think the image resolution is being limited to some extent by the lens. Hard to tell if the temperature data is still accurate.
Question for any TIC experts - would a bigger lens affect the calibration? (looks like you probably could recal via service mode though)

oh and for the web experts - by looking through the .asp files etc. can you deduce anything about what it actually does when you hit the 'enable service mode' button? Even a snippet of text that could be looked for in executables might be interesting. I have seen references to something like "oneshotservicemode"

[ixfd64]

I'm not sure if this helps, but I found these links to be quite interesting:

http://www.imc-store.com.au/v/vspfiles/assets/images/flir%20a310%20technical%20notes.pdf
http://support.flir.com/DocDownload/Assets/75/English/T559504$A.pdf (copy and paste the URL if it doesn't work)

[mikeselectricstuff]

Your second hyperlink is broken -- copying the URL and pasting it in works, however.

I think that's the same doc I linked to previously