Flir E4 Thermal imaging camera teardown

[sipo75]

itc has a YouTube channel

Emissivity Explained in Plain English


itc channel
https://www.youtube.com/user/infraredtraining/videos

[Mr-Beamer]

Probably some have already seen this

[mrflibble]

yeah, it's been discussed before. The unlock password is 1235.

[tom66]

Haha, how lazy can you get?!

[jdesbonnet]

Small (I hope) hickup on loading the FIF (E4 firmware 1.19.8, FLIRInstallNet from FLIR tools 4.0.13330.1003, Windows 7 64 bit). I'm getting a "RESPONSE_TIMEOUT" in a dialog box when attempting to upload the FIF file generated with the e4hack3b.zip and then:

Connection timeout
Operation aborted
NoAdapter

in the main area of FLIRInstallNet. The tool does find the camera as "FLIR USB Video -"  and the "Get Versions" button works (reporting the camera's firmware etc). I'm going to try rebooting windows but since I'm in that piece of junk only once a year it takes about a day to reboot thanks to uncancellable updates on power down.

Update 1 Dec 2013: Ya, took a while to reboot Windows due to all the updates since the last reboot about a year ago. So worked perfectly after the Windows reboot. What had me worried was that some elements of the FLIRInstallNet software were communicating with the camera, but not the FIF uploader.

[cynfab]

Figured out how to telnet into my E4+ from linux.

>>> EDIT and the web & ftp interfaces work too.
Make sure the camera is in RNDIS mode.
AND that this is the only network interface active at the time.

First plug in your camera, and set up the resulting pseudo ethernet interface (varies by distro) to have a static IP of
192.168.250.3.

>>>> EDIT could probably add the default GW as well in the network management tool.

Unplug the camera wait 5-10 seconds then plug it back in.

Then, as root,

arp -s 02:40:7f:xx:yy 192.168.250.2
-------^^^^^^^^^^   your mac address with 02 instead of  00 at the front.

I then ping the camera

ping 192.168.250.2

Then, again as root,

route add default gw 192.168.250.2

and lo I can telnet to the camera!

telnet 192.168.250.2

 I'd love for someone else to try this and see if it works for them, I've spent a lot of time going through WireShark dumps of ethernet traffic between the camera and Win 7 and this is the simplest way to brute force it in linux.
YMMV.
   ...ken...

[Fraser]

From FLIR's Youtube site.

How to make an MSX fusion image of a PCB by combining a thermal image with a separate photo taken with a digital camera. This could be useful when doing close-up work where the Ex camera is of little help. It looks like you need FLIR Tools+ but I believe that is available as a demo version ?

[Taucher]

Figured out how to telnet into my E4+ from linux.

>>> EDIT and the web & ftp interfaces work too.
Make sure the camera is in RNDIS mode.
AND that this is the only network interface active at the time.

Great news and congrats
Hint: you should be able to access the filesystem over the SMB share as well

Regarding "only active NIC" ... I'd try to get rid of the default gateway - and just add a route... this way your running IP setup should continue to work in parallel.

[cynfab]

Taucher,

I am by no means a networking expert, and this method can certainly be refined, but it is fairly simple and works. ;>))

[MrSquirrel]

So, exactly 3 weeks after giving my money to PASS, for a unit they confirmed to have, I finally received my E4 today.

Glad you posted that - it reminded me to check whether they credited the order i cancelled on 25th. Guess what - they haven't !

Going to kick up hell on Monday - this isn't funny on top of the pack of lies i've been spun (and clearly not the only one).

I won't be dealing with them in future, you might say i'll be giving them a PASS.

[cynfab]

And a somewhat simpler method

Make sure the camera is in RNDIS mode, other network interfaces are fine as long as they are not on 192.168.250.x.

First, on your linux box, as root:

echo 0 > /proc/sys/net/ipv4/conf/all/arp_accept

Then, as before, plug in your camera, and set up the resulting pseudo ethernet interface (varies by distro) to have a static IP of
192.168.250.3.

Unplug the camera wait 5-10 seconds then plug it back in. (This may not be necessary and there is probably an easier way )

Then you can ping, telenet, ftp, & use the web interface. I've tried the SMB interface, but it doesn't seem to work, probably due to the lack of NETBIOS exchanges that occurred on the Win 7 box.

[Taucher]

Nice Taucher
I see GoogleAnalyticsTracker.dll is in the previous version also
Without it in the progdir Flirtools crashes

Ok, stole myself some additional time and did an investigation on the Google Analytics DLL:

Found URLs inside DLL:
http://www.google-analytics.com/__utm.gif
https://ssl.google-analytics.com/__utm.gif

As said had to check my hosts file first ... had them blacklisted already...
0.0.0.0      ssl.google-analytics.com
0.0.0.0      www.google-analytics.com
... ok, temporarily redirected them for testing to my local http-server.. fired up the tools and   hold and beware...
BINGO, HOME-CALLING!
"Bloody, Spying BASTARDS"
 

This (and more) is beeing sent to Google:

When starting:   
   &utmn=<SOME NUMBER>
   &utmhn=<THE WINDOWS MACHINE HOSTNAME>
   &utme=5(Application start*4.0.13284.1003*)(0)8(Origin*OSCulture*OSBits)9(EXTERNAL*<LOCALE>*<OS-BITS>)....

When opening the images browser:
   &utmdt=Library Tab   

When looking at an image:
   &utmdt=Edit Window 
   
Feel free to contribute more!


I understand developers who want to optimize their product and provide the user with a better experience, but then... what for do they need my machine's name for?!
Tons of additional numbers beeing sent (click/mouse coordinates?) ... could also be encoded username, password, IP... (ok, that's now just my paranoia kicking in)...
Opt-out function: didn't see any

I don't like that at all!

PS: sending referer: http://library.tools.flir.com

[mrflibble]

Regarding rndis on linux, or windoze for that matter:

Code: [Select]

rls -ll .services.net.interface.RNDISFN1

# if this doesn't show the interface, force reconstructing resource tree
restartapp

rls -ll .services.net.interface.RNDISFN1

.services.net.interface.RNDISFN1: (8)
rw--rw--rw---p 0 root   root   <b> DHCP                       false
r---r---r----- 0 root   root   <a> actualAddress    "192.168.250.2"
rw--rw--rw--0p 0 root   root   <a> address          "192.168.250.2"
rw--rw--rw--1- 0 root   root   <b> commit                     false
rw--rw--rw--0p 0 root   root   <a> gateway          "192.168.250.1"
rw--rw-------- 0 root   root   <u> mac             "02:40:7F:xx:xx:xx"
rw--rw--rw--0p 0 root   root   <a> netmask          "255.255.255.0"
r---r---r----- 0 root   root   <a> tcpConnects      "192.168.250.1"


rset .services.net.interface.RNDISFN1.address 192.168.250.2
rset .services.net.interface.RNDISFN1.gateway 192.168.6.66
rset .services.net.interface.RNDISFN1.commit true

rdump -f \temp\net_gateway.rsc .services.net.interface.RNDISFN1

# inspect .rsc file, and when okay add it to the

move /temp/net_gateway.rsc /FlashFS/system/appcore.d/factory.d/.

restart

For testing purposes the gateway is now set to something different, while
the rest is still at default. Why? Because that way you only have to setup a
default connection between 192.168.250.2 (E4) and 192.168.250.1 (PC), and
you can check if the new setting based on resource has been succesfully
applied or not. I put it in appcore.d right now, but you might want to put network
related stuff in services.d.

If resource based config worked, then you can do a telnet and then "route
print". If you see the 192.168.6.66 test route then it worked. If not, then
not. Once you get a reliable method (so far it's too flaky) then you can
apply the proper static values you want.

As for usb plug in out in + adding default routes ... no need for all that. You can simply do this:

/etc/udev/rules.d/70-persistent-net.rules

Code: [Select]

#
# Flir E4 met RNDIS
#
# USB device 0x:0x (rndis_host)
SUBSYSTEM=="net", ACTION=="add", DRIVERS=="?*", ATTR{address}=="00:40:7f:xx:xx:xx", ATTR{dev_id}=="0x0", ATTR{type}=="1", KERNEL=="eth*", NAME="eth4"

Then in /etc/network/interfaces:

Code: [Select]

auto eth4
iface eth4 inet static
        address 192.168.250.1
        netmask 255.255.255.0
        up arp -i eth4 -s 192.168.250.2 02:40:7f:xx:xx:xx

Obviously change the xx:xx:xx entries to match your own MAC.

If you want your linux box to route packets for the E4 as well so you can
fuel your paranoia like Taucher, then you'll have to enable forwarding.
Personally I keep this OFF. If I need ftp forwarded I'll set up a seperate rule for that.

You can also enable DHCP using the above rset method if you feel like it.

SMB should just work. By default there isn't all that much to be had
though. Just the IPC ...

Code: [Select]

nmblookup -A 192.168.250.2

...

nmblookup IRCAM.... -B 192.168.250.2

querying IRCAM.... on 192.168.250.2
192.168.250.2 IRCAM....<00>

smbclient -L IRCAM....

smbclient  '\\IRCAM....\IPC$' 3vlig

And does anyone else get that the battery refuses to charge when it's really
low? Right now it's looooow, so I can start it for maybe 10 seconds and then
it goes poof again. When I show battery stats (hold LEFT + RIGHT cursor) it
shows Battery: 3%, 13mA ... but no charging (lightning) symbol.
Sound familiar, or do I just have a crappy battery or something?

Oh yeah, and I had some details on flash as well, but can't reach it now
because ... well 3% battery.  And NOT charging, GRRRRR.

[mikeselectricstuff]

Could be that when very low it starts charging at a low rate for a while in case it's a faulty batery

[Fraser]

I understand developers who want to optimize their product and provide the user with a better experience, but then... what for do they need my machine's name for?!
Tons of additional numbers beeing sent (click/mouse coordinates?) ... could also be encoded username, password, IP... (ok, that's now just my paranoia kicking in)...
Opt-out function: didn't see any

I don't like that at all!

PS: sending referer: http://library.tools.flir.com

FLIR use quite a tough anti-piracy procedure on their software as it is a very expensive optional accessory that they wish to protect. FLIR Tools is free but may be upgraded to FLIR Tools+. The activation of Tools+ is likely to be similar to that of the other FLIR software as it costs around $400.

Could it be that the Google data exfiltration is part of an anti-piracy protection system ?

Like you, I am unhappy if my computer is passing my activities with FLIR Tools to FLIR via Google collection agents. As I am registered with FLIR HQ they could likely correlate me with the build state of my camera so such data would not be anonymous. I don't recall agreeing to that but its likely buried in the EUL. Not too happy with this finding. ET phone home indeed ! 

[Taucher]

If you want your linux box to route packets for the E4 as well so you can
fuel your paranoia like Taucher, then you'll have to enable forwarding.


SMB should just work. By default there isn't all that much to be had
though. Just the IPC ...


And does anyone else get that the battery refuses to charge when it's really low?

@USB - Check your USB power status - lsusb -v / hwinfo --usb / hwinfo --usb-ctrl ... maybe hard-reboot your cam after hacking it's soul to death?

@SMB - did you note how niceliy the hostname is generated from the SN? 

@Paranoia - I'm still missing my http://en.wikipedia.org/wiki/Tin_foil_hat .. my Idol:
 

[Taucher]

Like you, I am unhappy if my computer is passing my activities with FLIR Tools to FLIR via Google collection agents. As I am registered with FLIR HQ they could likely correlate me with the build state of my camera so such data would not be anonymous. I don't recall agreeing to that but its likely buried in the EUL. Not too happy with this finding. ET phone home indeed !

Well, my paranoid, default OS setup took care of that home calling - feel free to adjust your hosts-file or windows firewall rules to take care of the unwanted data traffic

[KingVidiot]

With these mods can you guys find a way to toggle the annoying calibration popup on and off?

I don't want to be streaming video to my computer and have that damn thing continue to popup. When I shoot video I don't care if it's always fully calibrated.

Heh, that was one of the first things I fixed. Damn annoying to have it perform a nuc (calibration) juuuust when you're doing a measurement.

Code: [Select]

# turn off auto-nuc
rset .tcomp.services.autoNuc.active false

# turn on auto-nuc
rset .tcomp.services.autoNuc.active true

# trigger nuc
rset .image.services.nuc.commit true

The idea is to turn off auto-nuc, and then trigger a nuc when you think it's useful. I.e between measurements. Or not at all. 

Happy uninterrupted video streaming!

I really need to be able to toggle the calibration for video streams (no choppy vids). I heard that you can force a calibration with one of the buttons, so it doesn't need to come on all the time.

OK, E4 hack is working well, but I need to fix this calibration step. What file do I edit to change the NUC values?

[mrflibble]

Could be that when very low it starts charging at a low rate for a while in case it's a faulty batery

Good point, and looks to be likely too. Right now it is at 4% and 35mA (as opposed to 3%, 13mA earlier on).

[Taucher]

I really need to be able to toggle the calibration for video streams (no choppy vids). I heard that you can force a calibration with one of the buttons, so it doesn't need to come on all the time.

OK, E4 hack is working well, but I need to fix this calibration step. What file do I edit to change the NUC values?

Manual Re-Cal(NUC): keep holding down "Playback"
@File: you can probably put it in any <additional config> file that you like <as long as it's getting loaded> - or just run the wanted commands via telnet before recording a vid.
If you're asking yourself about rset and how to ... -> use telnet and don't use any file as this will change the default settings after startup.

[mrflibble]

@USB - Check your USB power status - lsusb -v / hwinfo --usb / hwinfo --usb-ctrl ... maybe hard-reboot your cam after hacking it's soul to death?

Heh, did that already, and also changed usb ports. Nothing. To be on the safe side I hooked it up to the 100% Flir approved charger.... But it looks to be just a safe slow charge like Mike pointed out.

@SMB - did you note how niceliy the hostname is generated from the SN? 

I did notice that I am pretty sleepy. I'm not overly worried about serials though, but fixed on general principle, thanks. On that subject, you know you put your user/machine name in the HTTP request a few pages ago, right? Not that those were highly exciting, but just so you know.

[Taucher]

@SMB:
\\192.168.0.2\root$
\\192.168.0.2\windows$

[mrflibble]

I really need to be able to toggle the calibration for video streams (no choppy vids). I heard that you can force a calibration with one of the buttons, so it doesn't need to come on all the time.

OK, E4 hack is working well, but I need to fix this calibration step. What file do I edit to change the NUC values?

Manual Re-Cal(NUC): keep holding down "Playback"
@File: you can probably put it in any <additional config> file that you like <as long as it's getting loaded> - or just run the wanted commands via telnet before recording a vid.
If you're asking yourself about rset and how to ... -> use telnet and don't use any file as this will change the default settings after startup.

Indeed. I'd keep that bit of config non-permanent. Personally I'd use a telnet script. Or you can make a .FIF that executes those rset commands. That way before you start recording you do pointey clickey in FlirInstallNet, and apply that .FIF.

[Taucher]

On that subject, you know you put your user/machine name in the HTTP request a few pages ago, right? Not that those were highly exciting, but just so you know.

I assume you're referencing "EXISTS/EXISTSALSO" ... that's not my username or machine-name

[mrflibble]

On that subject, you know you put your user/machine name in the HTTP request a few pages ago, right? Not that those were highly exciting, but just so you know.

I assume you're referencing "EXISTS/EXISTSALSO" ... that's not my username or machine-name

That was likely since it was highly contrived, but you never know. But more importantly, 6% @ 1290mA. yay!