Flir E4 Thermal imaging camera teardown

[mikeselectricstuff]

I still do not understand where exactly is the problem. When you will receive 1.21, you can connect to it via FTP, erase complete FLASH and copy 1.19 there. Or am I wrong ? You can see all the appcore.exe and other files, so I expect you can overwrite it with previous version. Sounds so simple.

In fact I did hack the same way. I did not use fif and installator. I just copied config file via FTP.

FTP will only work if you can enable RNDIS.

They may have changed the cal data format so cal data from a later unit won't be understood by 1.19.
Anyone checked if the FPGA code has changed?

[Fraser]

Taucher indicated that te fw 1.21.0 FPGA program was very different, but that this may not be an issue as small changes in FPGA config cause large changes in FPGA program. I am not familiar with FPGA programming though. My only thought was that FLIR are locking down the FPGA to prevent fps hacking. If so, the E4's that we own may indeed have a fps vulnerablity. Remeber that report I received and commented to you by PM ? 

[mikeselectricstuff]

Taucher indicated that te fw 1.21.0 FPGA program was very different, but that this may not be an issue as small changes in FPGA config cause large changes in FPGA program. I am not familiar with FPGA programming though. My only thought was that FLIR are locking down the FPGA to prevent fps hacking. If so, the E4's that we own may indeed have a fps vulnerablity. Remeber that report I received and commented to you by PM ? 

You can't infer much from the amount of difference, just that it was different. I can't think of a reason why FPGA code would change to improve hack security other than if there was a fps vuln, however as the FPGA does a lot of signal processing, it's entirely possible that this could have been tweaked to improve performance of for other reasons. 

However it's not out of the question that they could have moved part of some critical function like CRC checking or code signing into the FPGA to make it a  lot harder to reverse-engineer from the code.

[Bolt]

I have 1.19.8 with all the enhancements here, and it

1) crashes several times with "appcore error" right after boot, in case it turned itself from standby to off previously. Example - use the camera, turn it off (standby), leave it 14 days untouched, it will turn itself to off in meantime. After boot appcore error appears.

2) sometimes freezes while working. It can freeze softly with some mess, noise, ghost, squares on screen. Or It can freeze hardly into black screen. Both needs battery remove. After power on it is ok. Always happened to me under freezing temperatures, never above 0°C.

Both time by time, not frequently.

I can confirm both.

I confirm too, happened after one-two days untouched (1) or after cooling (2), and after removing battery works ok.

Today it's happened again, and i try "to freeze" (outdoor temp was -10...-15 C). After turn on i see gray squares on startup, blue background instead IR image, measuring crossbar at upleft corner, and some other malfunction. Removing battery not helps. It turned out, file calib.rsc damaged, some binary data inside of text. Maybe other files too, but after restoring file from backup all works.

(sorry for my english)

[Fraser]

What version hardware is involved with these crashes and what Taucher Menu version is installed ?

[daves]

What version hardware is involved with these crashes and what Taucher Menu version is installed ?

1.0, menu 3 with zoom

[araugh]

received mine today, shipped from the lot that TEquipment got yesterday.  Serial number 639136**, Firmware 1.19.8, Calibration date January 29th, 2014


EDIT: Added calibration date

[tomas123]

there are only 2 points, where Flir can differ a E4 from a E8 while updating:

• the master config file with old crc check in flashfs\system\appcore.d\config.d\ and some entries in GUI files
• the eeprom entry

both points are hacked but who have the courage to update their E4+ ? 

let's see whether the new firmware has an open (root) FTP access or the internal server accept any *.fif files from FLIRInstallNet 

[olsenn]

FLIR could have stopped this much earlier if they wanted to. They waited until the sales slowed down, then pulled the trigger

[mikeselectricstuff]

there are only 2 points, where Flir can differ a E4 from a E8 while updating:

• the master config file with old crc check in flashfs\system\appcore.d\config.d\ and some entries in GUI files
• the eeprom entry

both points are hacked but who have the courage to update their E4+ ? 

let's see whether the new firmware has an open (root) FTP access or the internal server accept any *.fif files from FLIRInstallNet

Calibration data?
Model encoding in serial number?

Not that there would be any reason to try, but it would be interesting to see if applying the update to a hacked E4 preserved the hackeness.

[mikeselectricstuff]

FLIR could have stopped this much earlier if they wanted to. They waited until the sales slowed down, then pulled the trigger

Except we haven't seen any evidence yet that the trigger has actually been pulled, i.e. new FW in production units. They've just taken the safety off...

BTW are there any indications of software build dates in the new FW?

[tiagobaracho]

guys... i was looking for a IR camera and got to this thread an after reading few pages... i see a need in hurry to buy to be able to hack....
Can anyone tell me exacly what do  gain with the hacking ? is it FPS or resolution upgrades?
Thanks a lot

[dtbp]

Except we haven't seen any evidence yet that the trigger has actually been pulled, i.e. new FW in production units. They've just taken the safety off...

I was just about to say the same thing. Hopefully they hold off or at least give the distributors plenty of time to modify their orders so they aren't stuck with 80 units nobody wants or returns after checking the firmware.

[tiagobaracho]

I just had this conversation with the sales department. What do you think ? new version or older ? When was released the new firm
ware ?
[Tequipment] How can I help you today?
[Tiagobaracho] hi
[Tiagobaracho] I want to get one FLIR E4 Thermal Imager with MSX Technology 80 × 60 (4,800 Pixels)
[Tiagobaracho] but i need to know wich firmware version you have in stock... how can i know that ?
[Tequipment] Any units we have in stock would have the latest firmware available.
[Tiagobaracho] we.. it was just released a new firmware.... and i want with the older firmware.... but maybe your stock have the old one
[Tequipment] One moment, please while I check on that for you.
[Tiagobaracho] its important to my decision..
[Tequipment] we have no idea what version firmware is on our units
[Tiagobaracho] someone on stock department can give this info /?
[Tequipment] no..firmware info is on the camera itself..we do not open boxes..we ship our cameras in unopeneed boxes
[Tiagobaracho] can you tell at least how long ago arrived the stock you have today for sale ?
[Tequipment] a week ago

[dtbp]

guys... i was looking for a IR camera and got to this thread an after reading few pages... i see a need in hurry to buy to be able to hack....
Can anyone tell me exacly what do  gain with the hacking ? is it FPS or resolution upgrades?
Thanks a lot

Resolution only. From 80x60 to 320x240 thermal resolution. The fps will remain at 9. The Taucher menu adjustment adds nice functionality from the E8 and Exx cameras.

It is well worth the enhancement and is quite easy to do without damaging the device, provided you get the old firmware...

[araugh]

Hack was successful and extremely simple.  thank you so much for making this a viable tool, even at 80x60 is was a good deal, but at 320x240 I'd have gladly paid double, and I wasn't really in the market for a TIC before.

[tiagobaracho]

guys... i was looking for a IR camera and got to this thread an after reading few pages... i see a need in hurry to buy to be able to hack....
Can anyone tell me exacly what do  gain with the hacking ? is it FPS or resolution upgrades?
Thanks a lot

Resolution only. From 80x60 to 320x240 thermal resolution. The fps will remain at 9. The Taucher menu adjustment adds nice functionality from the E8 and Exx cameras.

It is well worth the enhancement and is quite easy to do without damaging the device, provided you get the old firmware...

thats great..... !!
In which latest firmware It can be done  ?

[daves]

In which latest firmware It can be done  ?

Please read first post on page 1, there is many interesting info you would probably need. 1.19.8 is the last one.

I just had this conversation with ... [Tequipment]

Well they did not help me neither. Finally I bought from PASS.

Anyway, someone here just bought from them and it was 1.19.8. They can also give you serial number (it is on box), so you can see if it could be old firmware.

See:

received mine today, shipped from the lot that TEquipment got yesterday.  Serial number 639136**, Firmware 1.19.8

[Fraser]

News from PASS (UK) regarding stock....

I have heard back from David at PASS:


Good afternoon xxxxxxxxxxxx


Again thanks for the heads up,

We are pleased to say that we have just received 35 x E4, which are still at the old firmware 1.19.8. These are going very very quick and we only have 18 units left.

I’m more than happy for you to tell people to contact me directly 01642 626142 as always.

Many thanks

David Atkins – Senior Account Manager
Certified Level 1 Infrared Thermographer
Test Equipment & Thermal Camera Sales

Tel: 01642 626142 (Direct Line)

Fax: 0870 143 1869

Mobile: 07792 742265

Email: dave@tester.co.uk


Get them while he has 'old' stock !

[Taucher]

First - regarding the 1.21.0 firmware I get the strong feeling that I2C is the major reason for the changes.
My strong impression is, that the HW detection solely depends on I2C data - where the basic factory config (hardware, sensor version) got saved (T# stuff).
That's why I can imagine the new "truck charger" driver is not what it seems to be but might be some kind of eeprom-lockdown module.

Mike - any chance for some x-ray images of the Ex-battery?


Before I forget them, here some memos from the last "binary inspection" run

Userlist:
   zorro
   anto9
   default
   flir
   3vlig
   root

VERIFIED (UserList is always: flir:3vlig):
   Services\SMBServer\Shares\Bin$      = \FlashBFS -> \\192.168.0.2\Bin$\system
   Services\SMBServer\Shares\Root$     = \FlashFS  -> \\192.168.0.2\Root$
   Services\SMBServer\Shares\images    = \FlashIFS -> \\192.168.0.2\images
   Services\SMBServer\Shares\windows$  = \Windows  -> \\192.168.0.2\windows$
   Services\SMBServer\Shares\temp      = \Temp     -> \\192.168.0.2\temp

WEBSERVER:
Comm\HTTPD\VROOTS\/Ram  = \Temp\   
-> http://192.168.0.2/Ram/ <- requested action forbidden (INDEX), but file-access works:
Example: http://192.168.0.2/Ram/postlog.txt

Comm\HTTPD\VROOTS\/Tmp = \FlashFS\tmp\
-> http://192.168.0.2/Tmp/ (index forbidden, but files accessible)

Comm\HTTPD\VROOTS\/service = \FlashBFS\system\web\service\ (UserList: flir)
-> http://192.168.0.2/service/ -> Service menu

Comm\HTTPD\VROOTS\/Prod = \FlashBFS\system\prodisapi.dll
--> http://192.168.0.2/Prod --> The server encountered an error.

Comm\HTTPD\VROOTS\/, = \FlashBFS\system\web\
-> http://192.168.0.2/ -> Service menu startpage
   
----------------
Other findings:

Restore registry from \Windows\default.fdf
Restore registry from \Windows\Drestore.fdf

\Temp\AutoTempAbsolute\
\Temp\Autosave\
\FlashFS\System\
\FlashFS\System\default_a\
default*.rsc
\FlashFS\System\default_b\
\FlashFS\System\initial.rsc
\FlashFS\System\default_a\initial.rsc
\FlashFS\System\default_b\initial.rsc
\FlashFS\System\ProgressAppLegal.dat

httpd:
AdminUsers
ADMIN
Basic


on first connect the driver assigns a different IP to my PC:
192.168.0.3 / 255.255.255.0 + 192.168.250.3 / 255.255.255.0

Autoload-stuff:
autoload.fif
"SOFTWARE\FLIR Systems\Applauncher
>LaunchFileAlt
\FlashBFS\system\applaunch.dat
eFLIRInstall.exe
,ContinueFile
eFLIRInstall_cont.dat

[tiagobaracho]

just bought from tequipment using EEVBLOG6 discount code and with overnight shipping 
I REALLY hope to get a 1.19.8...... as a friend here from this thread...
Now i will search for the steps to hack it here.
Thanks guys

[tiagobaracho]

is it a possibility in the future to be able to get higher FPS ? or is it the sensor that only can make 9 fps ?... just out of curiosity ..
Its funny.. i bout a DS2072a osciloscope that came with 70mhz... a hack in this forum made it go to 300mhz and few other functions , exactly as the 300 mhz model that costs 2570 usd. Now i bought one E4 for 988 and will get E8 in the end  that costs almost 6000 USD ?
Got to say.. this forum is great !
After the hack, is there anything different from the E8 ? or is it exactly the same ?
Thanks

[daves]

After the hack, is there anything different from the E8 ? or is it exactly the same ?

It has more features than E8. I suggest you to visit first page ;-)

[Taucher]

After the hack, is there anything different from the E8 ? or is it exactly the same ?

It has more features than E8. I suggest you to visit first page ;-)

But you don't get the additional battery and the front-label still says "E4"

[tomas123]

Before I forget them, here some memos from the last "binary inspection" run

WEBSERVER:

Comm\HTTPD\VROOTS\/service = \FlashBFS\system\web\service\ (UserList: flir)
-> http://192.168.0.2/service/ -> Service menu

Comm\HTTPD\VROOTS\/Prod = \FlashBFS\system\prodisapi.dll
--> http://192.168.0.2/Prod --> The server encountered an error.

I think you mean the old firmware.
in FW 1.21 there is no ProdISAPI.dll and folder \FlashBFS\system\web\service\