Flir E4 Thermal imaging camera teardown

[galstaf]

Sorry rest of the world, but for those of us in the US get a laser range finder! woohoo! ;-) The link to that other company is this form with their logo sneekily put into the corner.

http://distributoraccess.com/promotions/forms/FLIR-Q1-2014-Redemption-Form.pdf


BTW.. thanks to all the fine lovely peeps on this forum for the hack. I love my E4++ !
(I also would have not bought one without these nice updates).

[mikeselectricstuff]

Hey Guys,

here my short report:
Flir E4 bought at conrad (Austria, not Australia ) online store.
S/N: 6391 47XX
Firmware: 1.21.0
HW: 1.1L

This unit will go back, sadly.... 

Greetings Mr. Z

Any evidence of a warranty seal?
Any obvious new functionality (e.g. does the image browser now show time/date?)

[Z-mann]

Hey Guys,

here my short report:
Flir E4 bought at conrad (Austria, not Australia ) online store.
S/N: 6391 47XX
Firmware: 1.21.0
HW: 1.1L

This unit will go back, sadly.... 

Greetings Mr. Z

Any evidence of a warranty seal?
Any obvious new functionality (e.g. does the image browser now show time/date?)

Hi mike!
I gave the TIC a try, the menu is slow as a wet week
No added features (against your yt review), no the image browser still doesn't show time/date

The debugmessages (at startup) have been "cleaned" - they are only shown as long the flir logo is visible.
After that the TIC does the slow startup and shows the thermal image, but you can see they moved the debugmessages behind the progressbar on the bottom (you can see one or two pixels (height of progress bar) of changing text chars)

There are absolutly no broken warranty stickers (where is one?), the torx screws on the bottom doesn't look to be removed.
My guess is that this TIC I got wasn't orderd back from Flir, this a stock unit with 1.21.0.

FYI: I added the cal. date to my first post. It's the 14th Feb. 2014

Greetings Mr.Z

[OrBy]

Great stuff, is this implemented in the new version?

Sorry, some troubles during release. Try now, should be fine.

Shaping up really nice! Suggestion - can the option to output to PNG format be added so we can have lossless output? 

[uski]

Hi

Hey Guys,

here my short report:
Flir E4 bought at conrad (Austria, not Australia ) online store.
S/N: 6391 47XX
Firmware: 1.21.0
HW: 1.1L
Cal. date: 14. Feb. 2014

This unit will go back, sadly.... 

Greetings Mr. Z

###Modified: Added cal. date

Did you try the hack ?

Make a backup of the filesystem before sending it back ! It would be interesting to see what kind of CRC they use (I heard there is support for many different CRC types in the newest firmware)

[OrBy]

Just a short info:
Total commander on the E4... http://tcce.s3.amazonaws.com/b3/ce2/cecmd.arm.cab - this one works on the E4 (I selected the beta version)

Code: [Select]

380.416 cecmd.exe
 104.960 ftp.tfx
  13.312 LAN.tfx
  32.256 registry.tfx

Did you just use wceload to install that cab?

Actually I just unzip the cab (7zip or expand.exe) - then rename the files by educated guess (size, name artefacts) or a quick peek into the .000 file.
Unfortunately the TFX files don't seem to work (registry.tfx seems to be just a renamed .exe) - all you might want is the cecmd.exe

May be a bit late but got the reg editor to work!

I just dumped all the extracted/renamed files (like you said) into the \Program Files\ folder under \Total Commander\ and opened the plugins folder just by double clicking on it.

[Taucher]

May be a bit late but got the reg editor to work!
I just dumped all the extracted/renamed files (like you said) into the \Program Files\ folder under \Total Commander\ and opened the plugins folder just by double clicking on it.

Big thanks!
Had totally overlooked the \\PLUGINS directory that had appered in TC - the place where one puts the whole stuff does not matter as long as the tfx files are in the same directory with the cecmd.exe.

[ErchAngel]

Hi Guys,

Just received my E4 yesterday, ordered it Wednesday last week from a dealer in Ireland via Ebay. Did the "hack" and the menu modification and everything works wonderfully. Had to use a Win 7 computer though for the menu mod, as the TIC in RNDIS mode didn't work well with Windows 8.1.

Camera info:
Model: E4 1.1
Serial: 6391 44xx
Software: 1.19.8
Calibration: 5th February (Estonia)

Thanks to all of you guys for the hard work that have made this possible 

[Taucher]

It's a fine reg-editor... long click on HKLM etc. for COPY menu ... hit "tree", then select flashIFS ... registry branch dumped

There's information on the device-startup-sequence (Exx users: this might be interesting to compare -> touch, wlan, bt)
I've roughly collected the driver infos and annotated them as an overview.
Note: "!>" denotes non-generic Windows CE stuff (Flir specific)

Code: [Select]

Driver order (HKLM\Drivers\Active):
01 -> -NA-  -> drivers\builtin (busenum.dll)
02 -> -NA-  -> drivers\builtin\Error Reporting (DwXfer.dll) "Dump File Transfer" # Dw.Exe, UploadClient, System\ErrorReporting\DumpSettings, System\ErrorReporting\DumpFiles, \Windows\ExtraDumpFiles, ExtraFilesDirectory, \Windows\DumpFiles
03 -> I2C1: -> drivers\builtin\i2c1 (i2c.dll) # WritePacket, ReadPacket, ProcessPacket -> CEDDK.dll, CSPDDK.dll
04 -> I2C2: -> drivers\builtin\i2c1 (i2c.dll) # +> I2C_Close I2C_Deinit I2C_IOControl I2C_Init I2C_Open I2C_PowerDown I2C_PowerUp I2C_Read I2C_Seek I2C_Write
05 -> -NA-  !> drivers\builtin\CSPDDK (cspddk.dll) # Chip Support Package / GPIO / CLOCK / DMA stuff ## Check DLL strings!
06 -> NFY0: -> Notify (notify.dll) #Eventhandling: AC-(Dis)Connect, RNDIS, Wakeup, Network events, Sync, on Timechange
07 -> SSP0: -> drivers\builtin\NTLMSPP_SVC (ntlmssp_svc.dll) "NTLMSSP_SVC" # RC4, MD4, MD5, RSAenh.dll
08 -> DSK1: -> drivers\builtin\NAND_FLASH (flashmdd.dll+flashpdd_nand.dll) "Freescale NAND Flash Driver" [Startblock: 160/0x0A0 | BlockCount: 128/0x080] # MSFLSH60
09 -> SPI1: !> drivers\builtin\CSPI1 (cspi.dll) #camera/core serial programming interface -> SPI: Init,Open,Read,Write,Close -> requires cspddk.dll for I/O, DMA, CLK
10 -> GPT1: -> drivers\builtin\GPT1 (gpt.dll) # General Purpose Timer (Serial interface) -> High precision timer
11 -> DSK2: -> drivers\builtin\NAND_IFLASH (flashmdd.dll+flashpdd_nand.dll) "Freescale NAND FLASH Driver for Images" [Startblock: 608/0x260 | BlockCount: 0]
12 -> DSK3: -> drivers\builtin\NAND_BFLASH (flashmdd.dll+flashpdd_nand.dll) "Freescale NAND FLASH Driver for Binaries" [Startblock: 288/0x120 | BlockCount: 320/0x140]
13 -> COM2: !> drivers\builtin\COM4 (csp_serial.dll) "unimodem" -> zeus_serial.dll (Debugconsole or WLAN-UART?)
14 -> CRD0: -> drivers\builtin\credsvc (credsvc.dll) "CredentialManager" #numcreds: 0
15 -> CAM1: -> drivers\builtin\VCAM (vcam.dll) [Visual Camera Interface] -> MT9T111 -> Standby On/Off, 2MP Camera (needs, I2C for control) -> OV7740_Init
16 -> FMQ0: -> drivers\builtin\FMQ (FMQ.dll) -> ????? maybe ethernet switch driver ?????
17 -> CSI1: !> drivers\builtin\Camera (csi.dll, camera.dll{"CamBufferManager.cpp"}) ->  see VCAM, needs I2C for control
18 -> PIN1: -> DirectX\DirectShow\Capture (camera.dll)
19 -> NBT1: -> drivers\builtin\Netbios (netbios.dll)
20 -> SDC1: -> drivers\builtin\SDBusDriver (SDBus.dll) # generic SD card stuff -> SD I/O
21 -> NDS0: -> drivers\builtin\NDIS (NDIS.dll)
22 -> UFN1: -> drivers\builtin\UFN (usbfn.dll) #USB Functions, OTG support set to 0, "USB PMIC", not starting when KITL debug active (\Drivers\USB\FunctionDrivers)
23 -> UFC1: -> Drivers\USB\FunctionDrivers\CompositeFN ==> USBfn
24 -> -NA-  -> Drivers\USB\FunctionDrivers\RNDIS
25 -> -NA-  -> Drivers\USB\FunctionDrivers\Video_Class
26 -> PMI1: !> drivers\builtin\PMIC (pmicPdk_da9021.dll) # power management, battery charger, needs USB events (insert/remove on UFN1:) # Powercharge: 1300mA - else: 500mA # http://www.dialog-semiconductor.com/docs/site-pdf/dialog_pb_da9022.pdf?sfvrsn=2
27 -> -NA-  -> drivers\builtin\AFD (afd.dll)  # Mostly name resolution - IP stuff: DNS, PPP/ppp_peer, WINS, DhcpV6DNS, Netbios -> AfdRas -> Dppp.dll, TcpIp6.dll,
28 -> IPD0: -> TCPIP\IPDevice (tcpstk.dll "IP Stack")
29 -> TCP0: -> TCPIP\TCPDevice (tcpstk.dll "TCP Stack")
30 -> WSS1: -> Ws2Serv -> LSP -> NSPM -> (ws2instl.dll) # Winsock2: Bluetooth, IrDA, Tcpip:[TCP/IPv6][UDP/IPv6][TCP/IP][UDP/IP] [RAW/IP]
31 -> BAT1: !> drivers\builtin\Battery (battdrvr.dll) -> Batt: IOCTL_BATTERY_FLASHFILE, BATT:ReadFlirInfo, BATT:ReadFuelGuageFWVersion , needs I2C, maybe smart attery relic?
32 -> -NA-  -> Services (servicesEnum.dll)
33 -> HTP0: -> Services\HTTPD
34 -> FVD1: -> Drivers\FVD (fvd.dll) "FPGA" -> \flashfs\system\fpga.bin
35 -> TEL0: -> Services\TELNETD (telnetd.dll) "Telnet"
36 -> FTP0: -> Services\FTPD (ftpd.dll) "FTP"
37 -> UCS0: -> Services\UCS (ucs.dll) "UVC Command Service"
38 -> FIS0: -> Services\FIS (fis.dll) "Flir IP Service"
39 -> SMB0: -> Services\SMBServer
40 -> ??
41 -> Tel1: -> Services\Telnetd\NewSession
 

Code: [Select]

HKLM\IDENT -> Bootloader Date+Time: May 6 2013, 11:14:42
           -> Bootloader Version 16.03 (DEC)
   -> BSP: Z3   <---(Board Support Package)!
   -> NAME: IRCAM<Last4digits>

HKLM\Platform   -> MX25 Platform

Security providers: schannel.dll, ntlmssp.dll, kerberos.dll, spnego.dll, credssp.dll
Credential Providers: 65538: ntlmssp.dll, 65542: credprov.dll, 65544: credprov.dll, 65546: credprov.dll

Webserver:
Vroots: /prod -> prodisapi.dll
Adminusers: ADMIN
NTLM: 1

System accounts:
[HKEY_LOCAL_MACHINE\Comm\Security\UserAccounts\flir]
"NT"=hex:\
  01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,20,0a,\
  00,00,00,66,00,6c,00,69,00,72,00,00,00,01,68,00,00,10,00,00,00,10,00,00,00,\
  57,3b,c8,23,d1,5d,7c,21,a3,f7,b6,f3,bc,e7,bb,7b,00,00,00,00,04,80,00,00,10,\
  00,00,00,10,00,00,00,8f,83,0d,bc,19,4a,78,88,81,03,77,92,63,88,a9,05,10,00,\
  00,00,d4,7a,1d,88,91,a8,c8,af,01,3b,ef,4f,26,89,d8,67,14,00,00,00,2d,54,7d,\
  b7,7e,0e,65,a5,80,e9,06,c4,cc,ec,e1,48,6d,a6,86,5b

[HKEY_LOCAL_MACHINE\Comm\Security\UserAccounts\root]
"NT"=hex:\
  01,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,20,0a,\
  00,00,00,72,00,6f,00,6f,00,74,00,00,00,01,68,00,00,10,00,00,00,10,00,00,00,\
  18,f8,ca,0b,37,51,ad,6b,cd,4a,be,ec,58,17,db,f8,00,00,00,00,04,80,00,00,10,\
  00,00,00,10,00,00,00,2f,38,12,8b,1c,98,d3,45,56,33,a5,1e,b8,df,a2,36,10,00,\
  00,00,85,29,c4,8f,09,55,1d,39,52,17,95,a4,db,ac,42,27,14,00,00,00,ba,d1,17,\
  20,43,0f,49,c2,30,77,1c,5a,f9,0e,fb,34,28,97,c4,2c
Note: It seems the Ex ist a based on a Freescale i.MX25 V2 SoC - one can find helpful infos there... esp. regarding SoC security features.

Edit: Keyword "MCIMX25WPDK"
see also:
http://www.freescale.com/webapp/sps/site/prod_summary.jsp?code=IMX25_SW
http://www.freescale.com/webapp/sps/site/prod_summary.jsp?code=IMX25PDK

[Fraser]

If you look at the serial no. Vs calibration date list on the Useful Information thread something becomes apparent. Production appears to have slowed between 29 Jan and 5 Feb.

6391 44xx              29 Jan            1.19.8 E4 V1.1
6391 44xx              05 Feb            1.19.8 E4 V1.1

The production rate was pretty good up to that point, then stalled.

Firmware 1.21.0 appeared on FLIR's web site 5 Feb and in an E4 camera on 7 Feb. I have to wonder if the slow down in production was due to preparations for the change in Hardware build V1.1L ?

For potential E4 buyers, I recommend that you not risk buying a camera with a serial number later than 6391 4400 unless you can pre-confirm the firmware version.

[Z-mann]

Hi

Hey Guys,

here my short report:
Flir E4 bought at conrad (Austria, not Australia ) online store.
S/N: 6391 47XX
Firmware: 1.21.0
HW: 1.1L
Cal. date: 14. Feb. 2014

This unit will go back, sadly.... 

Greetings Mr. Z

###Modified: Added cal. date

Did you try the hack ?

Make a backup of the filesystem before sending it back ! It would be interesting to see what kind of CRC they use (I heard there is support for many different CRC types in the newest firmware)

Of course, not   
Sorry, the unit is on the way back, no time for the backup (i also don't know how to make the backup of the filesystem)

[dudepron]

bought 1/30/14
E4 1.1
SN 63912xxx
SW 1.19.8
Calibration 1/23/14 Estonia

[Taucher]

Well, example files with CRC03/CRC04 could help (probably via PM as SN included).

I expect the hack NOT to work with new firmware, just based on the cold analysis of the new firmware.

BTW: I'd love to get the microsoft CE emulator to load the NK.bin - but I guess there's too much HW stuff involved - all I get is a seemingly stuck emulator, no vga or console output... might needs some more tweaking - any hints (like "use this offset..." are welcome

[tiagobaracho]

i only bought the Flir E4 because of this mod....
But flir is not happy that sold few more E4 because of it..
FLIR is a huge company... that makes a lot of money....
they dont care too much if they sold 200....400 units more because of this... first of all,  they are well established and  dont want to be known as a company that everyone is hacking its devices...
They also dont want everyone knowing that the same cost they have on E4 they have on E8... So We know now that at least they do , above the profits on e4, moe :  6000 usd - 950 = 5050 USD on the E8 units... plus the profits on the e4 units.. If they do like 450 USD profits... its 5500 USD profits on each e8 units...
So if they didnt sell like... 20 units of the e8 because people saw the hack and bought ee, its 20*5050 = 101.000 USD of pure profits.. and insted got 20*450 = 9000 USD on the E4...
Sure on pure math in the end they might have earn more money with the E4 hack.... but they are not like me and you that the incoming is low..... They make millions.... so... 1 or 2 millions more and the name associated to be hacked... sure they dont like.

(sure i am discarding the reseller profits on those calculations just to exemplify)

[London Lad]

The design, development and tooling costs will have been spread over the whole E range.

Its imposable to look at the profit from just an E4 or just an E8

[tiagobaracho]

The design, development and tooling costs will have been spread over the whole E range.

Its imposable to look at the profit from just an E4 or just an E8

i don't agree..
If they sell the E4 for 980....
You can be sure they are making money...
So they do make it much cheaper... and the same hardware for the E8 means the same costs and much larger profits....
They large scale that they build  the hardware used in all other models that use the same hardware, mean a less cost of production on the large scale.  But in the end the price per unit is the same.... so..... sure we can do this math... they would never sell it for 980 if it costs to build 1000 or 2000....
I think it makes a lot of sense

[London Lad]

The design, development and tooling costs will have been spread over the whole E range.

Its imposable to look at the profit from just an E4 or just an E8

i don't agree..
If they sell the E4 for 980....
You can be sure they are making money...
So they do make it much cheaper... and the same hardware for the E8 means the same costs and much larger profits....
They large scale they do the hardware include the other models that use the same hardware..  But in the end the price per unit is the same.... so..... sure we can do this math... they would never sell it for 980 if it costs to build 1000 or 2000....
I think it makes a lot of sense

Its not as simple as that. Design, development and tooling costs are huge. You cant just look at the build cost and sale price of one unit.

[edavid]

Why do we have to repeat the same discussion over and over again?

[Taucher]

Why do we have to repeat the same discussion over and over again?

I'll explain it to you: you have read the thead, they did not

[tiagobaracho]

The design, development and tooling costs will have been spread over the whole E range.

Its imposable to look at the profit from just an E4 or just an E8

i don't agree..
If they sell the E4 for 980....
You can be sure they are making money...
So they do make it much cheaper... and the same hardware for the E8 means the same costs and much larger profits....
They large scale they do the hardware include the other models that use the same hardware..  But in the end the price per unit is the same.... so..... sure we can do this math... they would never sell it for 980 if it costs to build 1000 or 2000....
I think it makes a lot of sense

Its not as simple as that. Design, development and tooling costs are huge. You cant just look at the build cost and sale price of one unit.

I know that... but you are not getting my point.
The final price of production per unit (incluiding the design, tooling and everything else muts be under the final price right ?
They cannot be selling for 980 for example, and the costs were 1000... SURE that at 980 USD they are making profits..... SO.. exactly the same unit just under another configuration and another name, have the same costs per unit as the other one that they sell for 980 usd. but now they sell this other one for 6000usd

[tiagobaracho]

Why do we have to repeat the same discussion over and over again?

talking to me ?

[DaveWB]

If you look at the serial no. Vs calibration date list on the Useful Information thread something becomes apparent. Production appears to have slowed between 29 Jan and 5 Feb.

6391 44xx              29 Jan            1.19.8 E4 V1.1
6391 44xx              05 Feb            1.19.8 E4 V1.1

The production rate was pretty good up to that point, then stalled.

Firmware 1.21.0 appeared on FLIR's web site 5 Feb and in an E4 camera on 7 Feb. I have to wonder if the slow down in production was due to preparations for the change in Hardware build V1.1L ?

For potential E4 buyers, I recommend that you not risk buying a camera with a serial number later than 6391 4400 unless you can pre-confirm the firmware version.

Found a dealer with a 6391408x serial that they got yesterday, do you think Flir updated it or do you think its still 1.19.8?

[dtbp]

Since flir appears to be asking distributors to return old stock to them to be "updated", the list of serial numbers vs firmware version may lose accuracy over time. They most likely won't be issuing new serial numbers to cameras after changing the software.

You will want to verify their return policy just in case. Nobody here can tell you the firmware you will receive with absolute accuracy.

Caveat emptor.....

[Taucher]

applauncher.exe -> MANY changes, grown from 7840b to 18816b
default.fdf -> added new driver entry for FADDEV -> faddev.dll
faddev.dll -> NEW -> i2c related -> Some strings: IOPortLaserEvent / Failed to create Truck Charger event

Did I mention that applauncher.exe now contains a hardcoded reference to a FAD1: device... and the string "ThöR" (new PW?)
FAD1: requires access to the I2C2: device... my gut-feeling still tells me that's a new, somehow hidden protection mechanism.

[all_repair]

I know that... but you are not getting my point.
The final price of production per unit (incluiding the design, tooling and everything else muts be under the final price right ?
They cannot be selling for 980 for example, and the costs were 1000... SURE that at 980 USD they are making profits..... SO.. exactly the same unit just under another configuration and another name, have the same costs per unit as the other one that they sell for 980 usd. but now they sell this other one for 6000usd

It maybe E4 is meant to be using the rejected sensor which internal cost is close to zero.  If the sale is too good, the equation is thrown off the course.  Or the yield of sensors has become too good.