TL;DR : Summary of Hack
Update 27/10 - some info in this post is wrong - the conf.cfg file is specific to the serial number so the one (removed) in this zip won't work. You need to get your own by entering service mode via RNDIS, and copying the \temp\appcore.d\config.d\conf.cfg file it generates into \flashifs\hack
(Note I have sometimes seen flashifs getting renamed during service mode so it may be flashifs2)
This hack puts the E4 permanently into service mode. This gives full 320x240 resolution, hotspot/coldspot measuring mode and some more palette options.
The hack can be removed or hidden as desired via the USB interface.
It has only been tested with Firmware V1.18.8 It seems likely that 1.18.7 may be also OK looking at the update files.
WARNING There is a risk of bricking if you do stupid things. It may be possible to recover via USB bootloader menu but it is not known if this works with standard firmware files or FLIR tools.
In particular, if the applaunch.dat doesn't get to cmd /R, you may not be able to get back to a console prompt to fix any file problems, which would be bad, m'kay
Hack at your own risk.
Power up and plug USB into PC.
Copy all files from attatched zip to a new folder called hack in the root of the USB drive
Unplug USB.
Connect to serial console using Hyperterminal or similar (38400 baud)
Press enter a few times - you should see the \> prompt
At prompt type :
cd \flashbfs\system
copy \flashifs\hack\applaunch.dat
(Hit 'Y' at the confirmation prompt )
type applaunch.dat ** to check this file looks correct as a bad copy could brick the unit!
Power down (remove battery), and restart
Enjoy!
Notes :
If hack folder or files deleted or renamed, unit will start as normal E4. Will revert to hacked when folder replaced.
Make sure unit is not plugged into PC USB when cold booting - PC prevents bootup accessing hack files - unit will start as normal E4. Will start as hacked next time cold-booted without USB plugged in.
Quick way to tell if hack active - hotspot/coldspot measurement modes available
--------------------------------------------------------------------
Optional :
copy rndis_rndis.rsc over rndis.rsc to make USB work as RNDIS instead of mass storage+USB Video
copy rndis_MSD_UVC.rsc over rndis.rsc to restore to mass storage+USB video
This allows console access via telnet, file transfer via FTP and web access to service functions
FTP and web username flir, password 3lvig
Default IP 192.168.0.2 ( check using ipconfig)
You can do this at any time, cold reboot afterwards.
--------------------------------------------------------------------------
Changing startup screen (cold boot only)
Replace \flashbfs\system\bootlogo_legal.bmp ( copy from USB filesystem as per other files)
Original is 8 bpp windows bitmap.
Beware of changing format, as if progressap crashes it may not run the console prompt
--------------------------------------------------------------------------
Pinout for serial console
FFC connector accessable under label on front of lens housing
Looking at lens side with handle down
<left edge> <pin 16>....<pin 1>
Contacts are on bottom side (towards handle)
Pin 3 RXD
Pin 4 TXD
Pin 7 ground
Use 3.3v TTL level interface, e.g. FTDI TTL-232-3v3 cable
TTL232 Pin 1 (0v) to ground
TTL232 Pin 4 (TXD) to RXD
TTL232 Pin 5 (RXD) to TXD
Suggested FFC jumper cable molex Molex 0210200165 or similar.
--------------------------------------------------------------
De-hacking
Removing the hack folder will make it start as per normal E4.
If desired you can replace the hacked applaunch.dat with a copy of the applaunch_original.dat
This should return it to full factory condition.
This hack will be overwritten by a firmware update, as applaunch.dat will be overwritten.
See pic for FFC for position to access with just the 2 front screws - you may need to push away some rubber padding to get to it, and will need to tape your FFC cable to some rigid PCB to push it in.
Next time I get some PCBs done I'll do some FFC breakouts - PM me if interested