Flir E4 Thermal imaging camera teardown

[sofisticated]

Thank you very much Bookaboo for your reminder.

[x25]

Hi all. I can ask a question? My sellers no have Flir e4 with old firmware
But i can buy E5 with 1.21. (of course more expensive)
I can remake e5->e8. all too process? there are not any special features?

[mikeselectricstuff]

But i can buy E5 with 1.21. (of course more expensive)
I can remake e5->e8. all too process? there are not any special features?

Yes - exactly the same method

[TurboTom]

I know it had been discussed before but actually, being not too deep into programming, I had my difficulties understanding... 

What I would like to know is if there's a simple method to "disassemble" an *.rcc container. I'm aware that a tool had been published that would assemble several icons or other pieces of software into a single rcc file and I also understood that this is somehow related to Qt (I installed the free Qt package and felt "like a fish with a bicycle"...  ). Would it be possible for a member of this forum with more experience in these things than myself to extract two versions of the facet_z3.rcc for me? I'm asking because I'ld like to try to install the menu patch on a 2.3.0 version and it seems the aforementioned file contains some additional modules that are not included in the patch version. So I thought there may be a chance by comparing them and maybe merging parts of both files into one, to get a working patch version for rev 2.3.0.

I hope someone will be able to assist...

Thanks a lot and all the best,

Thomas

[Taucher]

...RCC...
I hope someone will be able to assist...

Well, the decompression tool is quite simple - it even exists as finished .exe
The harder part is re-compressing a modified container.

Anyway the RCC file mostly optical decoration as any changed menu will require re-signing/chechsumming the XML file.
I didn't look at the latest firmware (somebody donate a 2.3 cam to fiddle with) - but it's even possible that some parts of
the menu got hardcoded... who knows.

[TurboTom]

Sorry for my ignorant warning. I've succeed as described by Mike's older posts. It has a connection and I downloaded conf.cfc from my device. But I couldn't get it deeper. ftool.exe comes as "Tail part 2 invalid" and with a blank .txt file generated. It looks like decription is not working as vmp made. I'm adding my conf.cfc here if anyone can use it for decription...

Hey I've got an idea that might be worth trying - maybe too simple yet.

Since you've got your camera in rndis mode now, did you try to enter its web server (when plugged in in rndis mode and the flir drivers installed, log with your browser to 192.168.0.2 and be patient (takes some time). I don't know which functions are enabled in an ex-factory 2.3.0 but if you can enter the service menu (login: flir - password: 3vlig ), you may be able to access the EEPROM and edit the camera information and change it to FLIR E8 (EEPROM unlock password: 1235 ). Now your camera will be identified by FlirTools as an E8 (you will have to change the USB mode back to MSD). If you now force a firmware update, maybe the parameters for the E8 will be installed.

I'm not able to test this since my camera is just a "crippled" 1.19.8 (my own fault...) but it may be worth a try anyway. At least you wouldn't lose anything.

Cheers,
Thomas

[sofisticated]

Since you've got your camera in rndis mode now, did you try to enter its web server (when plugged in in rndis mode and the flir drivers installed, log with your browser to 192.168.0.2 and be patient (takes some time). I don't know which functions are enabled in an ex-factory 2.3.0 but if you can enter the service menu (login: flir - password: 3vlig ), you may be able to access the EEPROM and edit the camera information and change it to FLIR E8 (EEPROM unlock password: 1235 ). Now your camera will be identified by FlirTools as an E8 (you will have to change the USB mode back to MSD). If you now force a firmware update, maybe the parameters for the E8 will be installed.

I'm not able to test this since my camera is just a "crippled" 1.19.8 (my own fault...) but it may be worth a try anyway. At least you wouldn't lose anything.

Cheers,
Thomas

Hello Thomas

Now I tested your advice. I couldn't get in the screen for Service menu. I succeed on arriving browser  screen. When I click "service menu" it asks for password. Then when I put user: flir password: 3vlig it accepts it but "url not found" screen comes. So that means they closed that kind of entrance or they simply change to another reaching adress. After "url not found" I've cleared the adress part for "http://192.168.0.2/service/index.asp" to "http://192.168.0.2/service", but it resulted as "Access Denied".  I will put my screen caps at attachment.

I can copy all files that I see with Filezilla if it can be a use for you (I don't know how to take a full backup of cam. flirinstallnet.exe's Backup Camera tab is not responding as backup function). All files are about 34 mb, 15 mb when zipped.

Thanks

Tugbay

[Taucher]

I'm not able to test this since my camera is just a "crippled" 1.19.8 (my own fault...) -snip-

1.19.8 should be recoverable - what state is it at?

[TurboTom]

@ Taucher

the camera is actually working, yet I made the mistake to install the 2.3.0 update. So what I've got now is something like a "true" E8 but without the chance to install the extended menus. When I do so, the camera will boot (progress bar working) but when it reaches just the final step, the screen goes black. The network interface is still active so I can revert the patch and everything's okay again. I also tried installing the files of the menu patch one at a time, and as soon as I install the facet_z3.rcc container, the camera won't boot completely anymore. When I actually leave the rcc file original and only install everything else, the extended menus seem to work, yet the icons of the menu structure are missing and everything's arranged on the screen somewhat awkwardly... That's why I think there's a chance to assemble a new rcc container from the existing ones that may solve the problem. I'm aware that this may require some experimentation but at least it wouldn't harm the camery since the web interface keeps working all the time and I can always return  to the known running configuration.

I won't attempt a "downgrade" since I've heard from others that there's a good chance to end up with a "bricked" camera that way.

@ Tugbay

Seems like only the "user front end" of the web site is installed on your camera. But since this web site refers to the /service/index.asp page, there's little that contradicts simply installing these pages from a previous firmware version. I think I even did that on my camera after I installed the 2.3.0 update. If you need further info, please contact me directly by e-mail.

Cheers,
Thomas

[Taucher]

@ Taucher
...as soon as I install the facet_z3.rcc container, the camera won't boot completely anymore. When I actually leave the rcc file original and only install everything else, the extended menus seem to work, yet the icons of the menu structure are missing and everything's arranged on the screen somewhat awkwardly... That's why I think there's a chance to assemble a new rcc container from the existing ones that may solve the problem.

I took a look at the 2.3.0 firmware and the following tells me there's more to do to hack the menu:
applaunch.dat

Code: [Select]

.....
# doCRC FlashBFS\system\appcore.exe 1812480 3954364497
# doCRC FlashBFS\system\common_dll.dll 1224192 3691234647
# doCRC FlashBFS\system\appcore_dll.dll 708608 3352418829
# doCRC FlashBFS\system\progressapp.exe 29184 464017185
# doCRC FlashBFS\system\defaultusr.exe 5120 2332166433
# doCRC FlashBFS\system\chargeapp.exe 32768 4157672503
# doCRC FlashBFS\system\ui.d\design_ui_Z3.xml 36473 748083417         <<<<<<<<<<<<
# doCRC FlashBFS\system\ui.d\facet_Z3.rcc 293928 3897467070         <<<<<<<<<<<<
# doCRC FlashBFS\system\ui.d\toolbar-config_Z3.xml 1263 2286214514         <<<<<<<<<<<<
don't forget about applaunch.sgn - I guess it's simply a checksum to verify applaunch is unmodified.

you see: both the rcc and the xml required for a menu change are enlisted to be checked on boot.

[Taucher]

@TurboTom

I took the liberty to unpack the RCC of a vanilla 2.3.0 upgradepack and attach it to this message. It might aid you in your studies, but note as already told: any change will most likely require correcting checksums/signatures for the bootup-files.

[Taucher]

And while I'm on it: Post #5555

[Fraser]

IIRC we have a documented case of an E4 user who was able to downgrade his camera after FLIR had upgraded it with 2.3 during a repair. The user discovered that the encryption element of the newer cameras was not active in his older unite. I believe he had a FW1.19 HW1.1 camera. It is the HW1.2L cameras that seem to use an active encryption.

It would be worth you looking back through the last few pages of this thread as I am sure the user managed to restore his camera to the pre 'upgrade' condition. This will not work with a camera that came from the factory with FW2.3 as that has active encryption and will not downgrade without the bricking issue that you mentioned.

I recommend that you study the procedure, contact the user who did the downgrade and then return yours to its previous version as well. You can then install all of the nice upgrades including the Menu. I would not recommend upgrading to 2.3 after that though as I have no idea what that would do to you upgrades.Aurora


UPDATE:

My memory failed me on this occasion. I just found the posting regarding changing the FW2.3 camera that had been upgraded by FLIR. The user managed to achieve the 320x240 resolution but no mention of the Menu upgrade. Sorry.

https://www.eevblog.com/forum/testgear/flir-e4-thermal-imaging-camera-teardown/msg478595/#msg478595

[Taucher]

they really made sure people see this in the movie lol ... (transformers)
i wonder how much they need to pay

LOL, coincidently I've watched that (rather chaotic) movie yesterday and ended up counting all products placed...  had the same thought... esp. because the logo was shown on two towers for a very prominent timeframe - and later on thermal imaging was used in the movie to no sense whatsoever

Edit (my notes on the blatantly shown brands):

• Flir
  
• Skype
  
• Bushnell
  
• Rolls Royce and countless other car models and brands (Bugatti, GMC..)
  
• <brainless charly's angels hommage/ripoff>
  
• Beats (and some weapons)
  
• Vitesse - see Bugatti
  
• Bud light
  
• Goodyear
  
• Tuscegee <not a band>
  
• Epson (scenery)
  
• AIA (Pan-Asian Life Insurance Company)
  
• Clarion, Jvc, Sony, Pioneer, Kenwood (shop)
  
• Shuhli milk <joke brand on tainted chinese milk>
  
• AJ - Arma Jeans (see Armani)
  
• Victorias Secret <approved *G*>
  
• Gucci (glasses)
  
• Hitachi (scenery)

[luis garcia]

Does anyone have sent the E4 back to Flir for repair, with the E8+ upgrade done ? :-(
Is it possible to revert the upgrade back to 1.22 ?

[TurboTom]

@TurboTom

I took the liberty to unpack the RCC of a vanilla 2.3.0 upgradepack and attach it to this message. It might aid you in your studies, but note as already told: any change will most likely require correcting checksums/signatures for the bootup-files.

Taucher - thanks a lot for this. I added the missing files from the rcc file of the menu patch to this and "repackaged" it, without any modifications to the applaunch files - the camera works normally. I then copied design_ui_z3.xml and toolbar-config_z3.xml to the camera - the menu won't work anymore and I can only toggle the battery/memory card icons at the top of the screen on/off with the menu button. If I replace the design_ui_z3.xml with the original version, some of the extended menu functions work but others don't. Yet, the Icons are now complete - as expected. I guess I'll have to have a closer look at the two toolbar-config_z3.xml files. It should be possible to get at least the additional palettes, the zoom and maybe the measurements running. Unfortunately, I'll probably only be able to spent some time on this next weekend...

Thanks so far and all the best,

Thomas

[sofisticated]

I'm not able to test this since my camera is just a "crippled" 1.19.8 (my own fault...) -snip-

1.19.8 should be recoverable - what state is it at?

Dear Thomas

Thank you for your guidance. I am succesful of adding service menu activity. I used old service cluster from fw 1.18. It worked and now I can see many service related functions, specially EEPROM tab  with "edit Camera Information" tab. Now when I try to change my camera model name from e4 to e8 it also asks for eeprom unlock password. I tried 1235 but it didn't open it. still says locked. Is there any other eeprom unlock password that you can say to me to try.

Thanks again.

[TurboTom]

@ Tugbay - Strange that for you the EEPROM password isn't working. Maybe tomorrow I can mail you the web directory contents that I'm using.

@ Taucher - I got the menu patch working like I wanted to. Actually, with the merged facet_z3.rcc, all that was additionally necessary was to apply the mods of the patched toolbar-config_z3.xml to the original 2.3.0 file (I copied the missing presets.d files already beforehand). Now my camera "behaves" like a true E8 (also identification-wise) and has all the menu patches that I wanted.

In order to get the installation "clean", I've only got to correct the CRC's and file sizes in applaunch.dat and appkit.rev . Do you know what kind of "CRC32" is used here? When I use a standard CRC32 calculation tool and convert the result from hexadecimal to decimal, I end up with everything except what I find in the aforementioned files. Also tried the inverse or typed the numer in reversely but I wouldn't get close. Is there a special application available to calculate this "very peculiar CRC"?

Thanks,
Thomas

[Taucher]

Well, Flir has decided they have to invest in locking down their firmware to shitty resolutions and artificially reduced menus... and continue charging artificially inflated prices for the real, physical specs....

Seems competition decided there's space to expand: http://thermal.com/ ... I have read about a US$200 iPhone attachment camera from them.
Pixel resolution: 206x156 , -40°C...+330°C ... sounds like roughly four times the resolution of a Flir One.

German:  http://www.heise.de/mac-and-i/meldung/Zweite-Waermebildkamera-fuer-das-iPhone-vorbestellbar-2404242.html

[Echo88]

Very interesting Taucher  Would possibly buy if it was usable by pc and would stream via UVC/RTSP or similar.

[miguelvp]

I ordered one yesterday (Android) but they won't start shipping until the app is in the Google Play Store.
Timeline 2 weeks for Android, 3 for IOS.

Btw it's 6.6 times higher res but no optical camera, but higher res sensor, and can measure beyond boiling and freezing water.

I also signed in for the developers SDK.

[heavybarrel]

Ordered mine today for iphone! Thanks Taucher!! For 200 bucks that guy will come in handy for electrical field work.
Since i am already carrying my phone the small camera attachment might as well live in my glove box! (When i am not constantly fiddling with it that is!!!)

[ixfd64]

Maybe a bit off-topic, but FLIR is launching a new product on Monday: http://flir.com/newproduct

I wonder what it'll be?

[miguelvp]

Maybe a bit off-topic, but FLIR is launching a new product on Monday: http://flir.com/newproduct

I wonder what it'll be?

A $500 camera lepton based, they preemptive the announcement after seek released their product. It's on a comment from Mike in probably another thread in here.

Edit: Or was it the $995 industrial one, not sure anymore, whatever they do might be too little too late, we will see.

[mikeselectricstuff]

This I suspect - TG165 Lepton based thermal imager.
They're calling an imaging thermometer, presumably so it ends up on the same catalogue page as the crappy Fluke ones.
 
http://www.cityelectricweb.com/2014/09/flir-tg165-imaging-ir-thermometer/