Flir E4 Thermal imaging camera teardown

[Taucher]

I was wondering indeed if dropping the update files there could be a good move. Well, it won't hurt at that point, right ? Although I suppose I should probably put the latest firmware rather than the older...
Anyway, there is an eFLIRInstall.exe in the zip. Runing strings on it yields a bunch of interesting stuff, like
"About to destroy boot config to force TFTP download on next boot"
and all sorts of other fun things like
Usage: flash [cmd]
  -e <eboot.nb0>    Flash bootloader
  -n <nk.bin>       Flash OS Image file
  -n <fs.bin>       Flash file system image file(s)
  -b <bitmap.bmp>   Flash boot bitmap
  -c bitmap         Clear boot bitmap
  -f [<part>]       Create flash file system image file
  -nomount          Do not remount file system after file generation
  -k                Keep file system(s) mounted (caution)
                    This flag can be combined with any of the commands
  -l                No partition limit check when writing binary (caution)
  -destroy          Destroy boot config to force TFTP download on next boot

bit late to do anything, will wait until tomorrow morning !
Thanks for the hints

I should add that it's a WindowsCE exe ... and it's obviously at least good for exchanging the hardcoded BOOT-Logo 
And of cause put it extracted onto the drive ... BTW: I have confirmed eFlirInstall.exe / and *.fif are contained in gui_common_handlers.dll.strings ...

PS: still checking for the location of the mentioned error.txt - where it's defined there will probably be more stuff to discover.

[MrSquirrel]

I have done the i2c again:

The addresses 92h & 93h, AAh & ABh, AEh & AFh, D0h & D1h are the same as each other, the only difference between the pairs being the read/write flag which seems to be (luckily!) overwritten by the "r" or "w" argument.

The first 7 bits of the address byte are the address itself, the last bit being the read/write flag.

You can see this in your command output, 92h and 93h produce "read command 49" in both cases.

Some more i2c trivia:

Address 68 (D0h / D1h) is the DS1388 Real Time Clock.

Code: [Select]

\FlashBFS\system>
\FlashBFS\system>i2c.exe r d1 07 00
Open I2C device
I2C read command 68 7 returned: 20 46 21 4 6 3 14

\FlashBFS\system>

20 - Hundredths of seconds
46 - Seconds
21 - Minutes
04 - Hour
06 - Day
03 - Month
14 - Year
etc...

More interestingly there are two banks of 256 byte EEPROM in the RTC, but i can't find a way to read them directly. You should be able to read from address D3h for the first page, and D5h for the second page. However all i get is an error, looks like i2c.exe isn't able to output the sequence required to perform an EEPROM read on that slave, it's like shooting in the dark.

Anyway, back to your scheduled program

[MrSquirrel]

no FTP/Telnet access?

If it were mine at this point i'd hook up to the serial port - it's no doubt spitting out all sorts of helpful info.

Serial output in Mike's video:
https://www.youtube.com/watch?feature=player_detailpage&v=NtqUE67BUDI#t=2546

And don't forget what happens when you press the internal "load" button:

So if you hold the 'load' button down during startup.....

Bootloader 16.3 for ASCO (May  6 2013 11:41:42)
PMIC wake up: R5=40h E_SEQ_RDY  R6=1h E_nONKEY
PMIC status:  R1=1h nONKEY  R2=a0h COMP_DET GP_FB2
Fuel gauge check: res=1, voltage=3704
Reset reason (0x00000000): Power ON

Press [ENTER] to force OS/FS image update (MSD) or [SPACE] to cancel.

Initiating image update in 0 seconds.
Launching flash image  ...
+InitSpecifiedEthDevice
INFO: Trying to initialize the built-in USB/MSD...
MSD:: initialization
MSD: USB initialization completed

..and if you then plug it into the PC

USB Attach: High speed

Appears as a drive, but just a couple of uninteresting text files - probably looking for a firmware file to be saved

[Taucher]

A collection of EXE strings might come handy (taken from .21 firm):

appverif.exe
ChargeApp.exe
Dw.Exe
eFLIRInstall.exe
emulatorstub.exe
imjp31m.exe
rapiclnt.exe
rapisrv.exe
RegExp.exec
repllog.exe
rnaapp.exe
Running Etcha.exe
servicesd.exe
sync.exe
udevice.exe
\Windows\Dw.exe
\Windows\peghelp.exe
---------
appcore.exe
appservices.exe
\eFlirInstall.exe
gethwtype.exe
kitcrc.exe
resmon.exe
supv.exe
syslog.exe
taskmgr.exe
t\FlashFS\system\wlanconfig.exe
wzctool.exe

==================================
OLD firm:

appcore.exe
appservices.exe
CamTorrent.exe
CEMGRC.EXE
clientshutdown.exe
cmaccept.exe
conmanclient2.exe
eDbgTL.exe
\eFlirInstall.exe
fmqping.exe
gethwtype.exe
kitcrc.exe
resmon.exe
supv.exe
syslog.exe
taskmgr.exe
t\FlashFS\system\wlanconfig.exe
wzctool.exe

[OrBy]

I wonder if dropping the NK.bin file from th 1.21 update onto that partition then using something like option 5 from the serial debug port:

..and if you send a <space> to the UART during boot....
<quote>
SETTINGS:
0) IP address: 0.0.0.0
1) Subnet Mask: 0.0.0.0
2) Boot delay: 1 seconds
3) DHCP: Enabled
4) Reset to factory default configuration
5) Autoboot: NK from NOR
6) MAC address: 00:40:7F:0B:91:39
7) Host connection: (USB MSD)

ACTIONS:
S) Save configuration
D) Download image now
L) Launch existing flash image now
R) Launch existing flash image now in SAFE (restricted) mode
E) Erase flash file system area
B) Erase OS Image area
</quote>
Option 7 may be intersting - options are USB BSD, ETHERNET and USB RNDIS, which provides virtual ethernet over USB - fairly sure the latter is what enabled the i7 hack - unfortunately I've lost the email I had about that.
Safe mode doesn't do anything interesting

would be the best way to get it back up and running?

I would at least try dropping that nk.bin on there and rebooting the camera to see if anything happens and if you want to try taking it apart - try pressing the load button like suggested above.

[Taucher]

... with 2 files, ERROR.TXT which says "no error" (how ironic) and TYPEINFO.TXT which has
FLIR cam boot
MSDcmd 1.3
ASCO
and then 2 serial (including the one from the unit) and the ethernet MAC of the unit.

Just a short notice: I failed to quickly find "ERROR", "TYPEINFO" or "NK from NOR" anywhere in the firmware update files.
Btw - I'm wondering what MAC that might be - RNDIS "MAC", FPGA "MAC", SUID (maybe MAC with some static garbage to obfuscate it?

[OrBy]

... with 2 files, ERROR.TXT which says "no error" (how ironic) and TYPEINFO.TXT which has
FLIR cam boot
MSDcmd 1.3
ASCO
and then 2 serial (including the one from the unit) and the ethernet MAC of the unit.

Just a short notice: I failed to quickly find "ERROR", "TYPEINFO" or "NK from NOR" anywhere in the firmware update files.
Btw - I'm wondering what MAC that might be - RNDIS "MAC", FPGA "MAC", SUID (maybe MAC with some static garbage to obfuscate it?

The MX257 has a 10/100 Ethernet MAC intergrated but the E4 lacks the ?PHY? to connect it. 

[mikeselectricstuff]

@FPGA experts: I'm guessing the FPGA has a factory deployed serial number - my guess is it's the new GUID code

Not sure what you mean... The FPGA is loaded from a file at startup - it wouldn't have any device-unique data. Some FPGAs (e.g. Spartan 3) do have a factory-set unique serial number - not sure if the one in the Ex does but easy enough to look up. Not sure how this would be useful in this application though - I think it's mostly about copy protection.
 

[fp]

I'll try to drop stuff on the partition and see what happens, but I am not over-optimistic about it; I don't feel confident enough to tear it open at that point, although I agree it would be interesting to connect to serial...

[fp]

So, copying the eFlirInstaller.exe and the fif on the FAT partition does not produce anything: actually, it does, files are erased upon restart. Any file (other than the ones that got their in the first place) is erased, for that matter, and nothing happens.

At that point, I cannot do more until I get it fixed/exchanged and then I will be more cautious.

Hopefully by the time I come back to the forum there will be progress 

[stefbeer]

I would at least try dropping that nk.bin on there and rebooting the camera to see if anything happens [...]

@ fp: Could you try that? I don't think the bootloader can handle the .fif-"Package". Worst case is that it also gets deleted upon reboot.

[fp]

just dropped nk.bin there. Same result: gets erased on cold reboot.

Both updater scripts (1.18 and 1.21) have some failure handling at the end (past asking for reboot). So obviously what happened was beyond that. In retrospect I was careless, I should have stopped before rebooting and tried to play with telnet. Oh well.

[Fraser]

This may have just been an unfortunate accident but we should not dismiss the possibility that FLIR considered the old or modified firmware upload vulnerability and decided that the response should be system erasure ! Pretty extreme but it will ensure that the unit is not in a useful condition for hacking and it can be restored to operation by FLIR Service Techs. This may be another reason why firmware 1.18.7 was removed from the FLIR web site. This may also tally with the reason for returning a 1.19.8 camera to FLIR for 'upgrade'.... adding a countermeasure against any form of unofficial or old firmware upload attack vector.  I have seen this type of countermeasure used on secure systems......its a form of agressive IDS that responds by making the host a non operational paperweight and so protecting against further hacking or probing.  Sadly it then effectively becomes a denial of service attack !

We should not forget that this technology is ITAR liable and the normal etiquette for not disabling a product if hacking is attempted may not apply. If there is any risk of an E4 being upgradeable to >9 fps it would be a legitimate countermeasure to disable the product to ensure that it is returned to FLIR for investigation and potential reporting of a hacking attempt against the platform. The regulations clearly state that a TIC's lock-down should not be removable.

Be careful out there !

[Rainer]

is there any possibility to do a normal complete 1.21-firmware-update-process?

or if you compare the downloadable 1.21-image with your backup, is there a special config-file in the Windows-folder?



Next question for crypting and decrypting the config.cfc:

If the encryption use a "special information"  from TIC-HW, which information is in the update-image? Flir need the encryption for locking the TICs with old 1.19-firmware.

Do flir give an uncrypted config-file to the TIC-system and crypt this on the TIC while update-process?

[Chorleybloke]

Hi all

I've just joined up, and only wish I had seen this site prior to purchasing the E4,  (1.21 firmware) Although its well made.
I am seriously disappointed with the Camera. other versions are way out of my price range and I’ve gotta say if anyone is looking to get one (An E4) don’t bother unless Flir decide to allow it again or an unlock method is found by you guys on here.

Although I understand basic electronics (Very basic) reading some of the replies has already got me confused.!!!!!!! But I am hoping there is a way to crack it, even if it is by spreading the word just how basic these are in its Standard E4 format.

I’ve spent a few hours pressing and holding buttons in various order and discovered to “hidden” one that has the USB RNDIS screen, but haven’t a Scooby doo clue how to then copy the software etc.

Hope I ain’t being too numb, maybe one of you guys could explain how.

Have fun guys

[Rainer]

tsg, you can post the next(third) full-backup for analysis.

Just install the filezilla and the flir-network-driver on your pc,

then go in TIC in the hidden menue(Settings->device-settings->camera-information->10 seconds right and activate in the usb-menue the RNDIS-option)
(later you can do in the same way to reset to the UVC and MSD-option)

If RNDIS is on, connect  with filezilla to 192.168.0.2, user: flir, pass: 3vlig and dowload and zip all files.

Then post the zip here und give some information about your cam (you find the data in the camera-information-menue)

all this operations don´t touch any warranty

here is the driver:
http://cdn.cloud.flir.se/swdownload/assets/other/flir_device_drivers.exe

...

[Chorleybloke]

Thanks Rainer, I will have a go later, I'm supposed to be working right now so will be back on later. Is it possible that what ever they have done could be so so so simple, that it would be so hard to spot? if that makes sense.

[Fraser]

To balance the post from Chorleybloke,

Thermal Imaging Cameras have been out of the financial reach of mere mortals for decades. They used sophisticated technology that was not available for DIY or budget builds. Many experimented with simple slow scan pyro thermometers and received pretty poor reults as a consequence.

FLIR have produced many models of TIC over the years and are experts in the field. For reasons not known to me, they decided to venture outside the industrial world in which they operated and into consumer products.

Their latest series, the Ex, offers consumers levels of image clarity and performance not previously seen at the price point. Depending upon the application, the E4 80x60 pixel low resolution can either be adequate or useless. If you are looking at switch gear, fuses and buildings, the low resolution should not be an issue. If you are looking at SMD components on PCB's it will be found wanting in the thermal image clarity realm. That is just the 'you get what you pay for' situation.

The MSX visual camera feature should not be underestimated. It provides the target outline detail that gives an image context. I used to need higher resolution 'thermal only' images to achieve the same contextural information. Whilst thermal image resolution is definitely important, it is less so when you just need to know what area of an image is warmer of cooler and in what context. i.e where exactly is the hot spot on the target....such as a motor bearing. You do not necessarily need an amazing resolution to know that a motor bearing or circuit breaker is getting too hot !

Whilst it is true that the upgrades that I performed on my E4 completely transformed its performance (especially the resolution and manual range control upgrades) I would not say that the standard E4 was poor value for money or useless at the $1000 price point. Those who do not agree should study the history and prices of thermal imaging cameras before judging the E4 too harshly.   

For info only. As I have stated before, my FLIR PM695 320x240 industrial cameras cost over $55,000 each  That was in 2007 and the new equivalents still cost that sort of money today. Suddenly $1000 for one quarter of the resolution does not seem such bad value for money.

And do not forget that the E4 lens focus may be easily changed for close up work using either a lens adjustment tool or a $30 ZnSe auxilliary lens. The thermal image detail improves the closer you get to the target due to equivalant pixel size.

[Yama13]

+1 Auroroa.

I only registered to keep up to keep up with this thread and post the info on mine for the database.  Although I modify and work on audio circuits, this is out of my realm.  I bought my E4 late, so knew there was a possibility it would be the 1.21 version - but felt in the end it didn't matter if it was (I lucked out and got a 1.19).

At this price point, the base features/quality/warranty/useability - especially with the MSX - is unheard of until now.  I have wanted a TIC for years now, but could not justify it because of the cost for my use (just checking stuff around the home - not electronic monitoring, though I have used it for that as well).

Now that I have it I have actually decided to use it as is (for now) because the MSX shows me everything I need.  This is a great TIC and incredible value at this price point.  Before, the closest I could find was the i3 @$1500, which is the same 80x60 WITHOUT the MSX.  When I looked at the sample images at the time, I thought "meh, not worth $1500."

The E4, however, with the MSX and $500 less blows the i3 away (to me).  Plus they have that special going til the end of this month where you can get a rebate in the form of your choice of one of 3 test equip (meter, video borescope, and I forget what else), each valued at about $130.  That makes it an INSANE value (I think the rebate stuff is US only).  It's like getting the E4 for $870.00 - almost half the cost of the i3 just a short while ago!!!

[Chorleybloke]

Hi Aurora,

I fully understand what you say and I don’t want to slate the E4 as being totally pants, I use it for Building work. Having used others, I knew what to expect from an E8 but would NEVER have purchased one, but was willing to get an E4 and do the unlock. Unfortunately FLIR stopped this whilst I was awaiting delivery, hence the extended delay in it arriving.

Although the E4 is as you say a good purchase at just below £1k, regardless of its value its is still a pretty basic image compared to the full 320 x 240.  Obviously I’m sulking that I cannot upgrade my E4 to the full resolution, and if I had know when I placed the order that I couldn’t upgrade, I’d have just cancelled the E4 order, yet also would not have waited or saved the cash to splash out to get the E8 either.

It’s all irrelevant to Flir now as they still got my sale regardless of “unlock ability” ?. But even if I had known that FLIR had stopped the firmware upgrade it doesn’t change that I could not afford or warrant the cost of the E8 in my circumstances.

Maybe it was deliberate from FLIR to allow so many out that could be unlocked, after all I purchased one in the hope it could, and that’s because when searching for a Thermal Camera initially it was the publicity that the E4 was getting that drew me to order. Maybe those FLIR guys are not that daft after all and It was just some elaborate marketing campaign to increase awareness that ultimately has worked, FLIR must have had an increase in sales surely?

I I’m not for one minute taking anything away from the fantastic work you guys are doing, I only wish I a 10th of what you guys know or can do when it comes to stuff like this, but I just wanted to know that even for the Bargain price the E4 is, I am still disappointed with it.

I’m hoping you guys can find out just what they did………


Good work guys,,,,,,,,Chorleybloke

[Chanc3]

Hate to say this guys, but it looks like the camera may now be hack proof - or at least incredibly difficult to re-hack!

[mikeselectricstuff]

FLIR have produced many models of TIC over the years and are experts in the field. For reasons not known to me, they decided to venture outside the industrial world in which they operated and into consumer products.

Their latest series, the Ex, offers consumers levels of image clarity and performance not previously seen at the price point.

I'd hardly call the Ex a consumer model - it's clearly aimed at professionals in the HVAC, building and  and electrical markets.
professional thermographers may scoff at it but I suspect at least some of that is fear that their clients will buy one and stop calling them.

FlirOne is of course clearly aimed at the consumer
 

Whilst it is true that the upgrades that I performed on my E4 completely transformed its performance (especially the resolution and manual range control upgrades) I would not say that the standard E4 was poor value for money or useless at the $1000 price point. Those who do not agree should study the history and prices of thermal imaging cameras before judging the E4 too harshly.   

Absolutely - even without the hack, the E4 is by a fair way the best price/performance TIC available, and apart from very close-up PCB work, the MSX makes a huge improvement in useability over what would otherwise be a borderline-unuseable low resolution thermal image.
I would however argue that the E8 looks very poor value compared to the competition, including the lower Ex0 models.
[/quote]

[Chanc3]

I'd hardly call the Ex a consumer model - it's clearly aimed at professionals in the HVAC, building and  and electrical markets.
professional thermographers may scoff at it but I suspect at least some of that is fear that their clients will buy one and stop calling them.

FlirOne is of course clearly aimed at the consumer

I sincerely hope thermographers are not using the E4 for building inspections, bearing in mind the standards state you need at least a 320x240 detector size.

[OrBy]

So, copying the eFlirInstaller.exe and the fif on the FAT partition does not produce anything: actually, it does, files are erased upon restart. Any file (other than the ones that got their in the first place) is erased, for that matter, and nothing happens.

At that point, I cannot do more until I get it fixed/exchanged and then I will be more cautious.

Hopefully by the time I come back to the forum there will be progress 

just dropped nk.bin there. Same result: gets erased on cold reboot.

Both updater scripts (1.18 and 1.21) have some failure handling at the end (past asking for reboot). So obviously what happened was beyond that. In retrospect I was careless, I should have stopped before rebooting and tried to play with telnet. Oh well.

Sounds like that partition is some sort of service ramdisk used to bring the unit up after it's manufactured. Turn the thing on - connect it up - read the files (no error file for everything booted ok and the other file to give the prep PC something to prepare the initial firmware load with) then write the firmware issuing a command from the serial console to flash or maybe that hidden load button. I don't think your going to be able to restore that E4 without connecting to the debug serial header and mabe some special files/software that FLIR is unlikely to give out.

[Fraser]

Mike,

Its a little like  the comparison between the compact fully-auto digital snapshot camera and a highly sophisticated, Auto/Manual Pro SLR. A professional can use either and likely take good pictures with both BUT when asked which is aimed at the consumer market, there would be little doubt that 'Consumer' described the Compact better than the very sophisticated, complex and expensive SLR ..... I suppose its all relative really 

To me, as a user of the more complex cameras, I see the E4 as a relatively simple camera which is easy to use, but limited in functionality, especially in that it has no manual control over span and centre temperature. So for me it is the Fully Auto 'Compact' of the thermal imaging world  After upgrade, it becomes a far more 'professional' camera in terms of capabilities and I like it a lot. It's only negative throwback to its original form is the small fixed focus lens that cannot be easily changed.